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1.1 Purpose 

This document is a manual for system administrators on the 
Multics system. It does not describe the internal structure of 
the system-administration data bases or the programs which 
manipulate them: consult the MPM SPS and the MSPM for these 
details. This manual is intended to be a useful guide for the man 
who has to set up and run a Multics system. 



1.2 Resource Control 

The overall Job of the Multics system-administration programs is 
to control the use of system resources and to keen records about 
how they were used. They must also support rationing of 
resources* provide system security services* and produce usage 
reports and bills as required. 

Multics resources are used by logged-in users * each of whom has 
(at least one) 2L2L£2SS under his control. The user Is 
identified* when he attempts to log in* by his person TO and his 
project 10. A process is then created for him, and his resource 
usage is metered by various hard-core modules. These meter 
readings are collected and kept in the Multics storage system, 
and are made available to the resource-monitoring and billing 
programs. 

In order to log a user in* some process must execute a program 
which reads the supplied lo.gin request line and password* and 
checks them agains the list of valid users* also keot in the 
Multics storage system. To provide maximum protection for this 
segment* the process in which the login program executes is a 
fictitious user of the system* called the "answering service." 
(This process is also called the "initializer process*" because 
it is the orocess created during the system initialization 
sequence* and ths "system control process.") Almost all 
resource- usage metering functions a«~e perfprmed in the 
initializer orocess. The generic term for the thirty or so 
programs which deal with system resource control is "user 
control" or "system control." 

The administrative and resource-control functions of Multics 
comprise a sizable subsystem* which* like the rest of the 
operating system, is designed to continue to grow, and to allow 
many ootional facilities which a particular installation may 
decide to bypass. 
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The system administration facilities are organized into several 
functional areas, with well-defined interfaces. There are six 
major areas* each of which contains several subsystems. 

1. Hardcore resource multiplexing and metering. The central 
oa^t of the supervisor, esoecially the Traffic Control* Page 
Control, and fault and Interrupt service modules, has 
primary responsibility for providing users with access to 
the system's resources. These modules also keep extremely 
fine-grained meters which record the usage of each process. 

2. Hardcore interfaces to the user. The Multics Storage System 
provides Directory Control services which organize data for 
a user and control access to data, and keen fine-grained 
meters and quotas on storage usage. The Interprocess 
Communication facilities allow for synchronization of and 
cooperation between processes. 

3. Other supervisor services. Other tape and data-management 
services are also provided by the Multics supervisor to 
allow users access to system resources and to control the 
manner in which these resources are used. 

k» System control. User identification and login control, 
basic accounting functions, file backup, control of shared 
devices such as line printers, and operator communication 
are provided by system control. 

5. System Administration. User registration services and 
billing operations are performed by the system 
administrators. This manual is primarily a guide to the 
ooeration of programs in the system administration area. 

6. User project administration. Some grouos of users may have 
the ability to manage some of their own resources. This 
manual, and the Multics Project Administrator's Manual, 
describe operations in the user project administration area. 
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1.3 System administrators 

There are three kinds of system adm i n is tra t or s * 

1. Unrestricted system administrators. 

2. Restricted system administrators. 

3. Project administrators. 

The system administrators are users of Multics like any other 
users. They must log in the same way that other users do * and 
when they log in a process is created for them in the same way as 
for other users. They differ from other users of Multics in that 

1. They have access to certain segments which regutar users 
do not. Tt is possible* but not necessary* for them to have 
access to al I segments In the system. 

2. They use special programs to manipulate the accounting 
data bases. In general* these programs do not make 
privileged calls? they are ordinary PL/1 programs which 
manipulate data in ordinary ways. The data for these 
programs* though* are accounting records and control 
segments which normal users have no access to. 

3. The system will grant certain requests for them which it 
will not grant for normal users. In particular* the 
initializer process will install system tables for system 
administrators* to change passwords or add new users* 

Some privileged calls are available to the system 
administrators. A system administrator is quite often a 
very experienced system programmer* and so some special 
abilities* such as the privilege of being aM e to patch the 
system, are available to the system administrators* Almost 
no use of this ability is made in the design of the 
system-administration package. 

The restricted and unrestricted system administrators are users 
on the project "SysAdmin", Since they therefore have access to 
the system-administration segments and programs* they can 
completely control the system's resources. A restricted system 
administrator has a special initial procedure* 



accounts_overseer 



which provides him with a special set of commands designed for 
system administration. Although a restricted system 

administrator has access control privileges which would 
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ootentially enable him to destroy any segment in the system, he 
is traDoed in his soecial command system* and so can only oerform 
soecific accounting functions. 

An unrestricted system administrator can use any Multics command. 
(He may also use the soecial command system.) Because the 
unrestricted system administrator can cause damage to the segment 
hierarchy, circumvent access control restrictions, and destroy 
resource accounting, only careful and carefully-trained 
programmers with a good knowledge of Multics should operate as 
unrestricted system administrators. 

°ro]ect administrators are in charge of a particular project. A 
system administrator can function as a project administrator for 
any oroject. Initially, all projects are set up with only the 
system administrators. If a project needs more control over Its 
usage than the system administrators can orovide, they may 
del egat e control of the oroject to a project administrator. 
Project administrators, too, can cause damage to segments, but 
only those of their projects. They should therefore be 
responsible individuals who are willing to do the necessary work 
to keeo rrojects running smoothly. Project administrators are 
usually normal Multics programmers who have taken on additional 
respons ib i I i t ies? they are given no special command system, but 
certain commands will work for them which will not work for 
non-admin istrat or s. 
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l,k Definitions 

A perso n is a human being or something (such as a daemon) that is 
treated like one by the system. Each registered person Is 
identified by a strinq of one to 22 characters* beginning with a 
capital letter* called a person, 10* which is unique within the 
installation. Usually, the person 10 is the person's f as t name. 
Each person has several attributes which the system remembers* 
including a personal password and a default project in. These 
items* along with information about the user such as full name 
and title* mailing address* and programmer number, are maintained 
by the system administrators. 

The term user is used in two different ways. We often speak of a 
logged-in person as a user* and* sometimes* use the term to refer 
to the process which the user is controlling from his terminal. 
Especially in the context of user control* however, we apply the 
tern? u.s_ex. to any member of the set of users (in the first sense) 
who c.o.uJ.d. log in. In other words* we speak of a user* as a 
registered identity. 

A pro jeQt is a grouping of users for resource control purposes. 
Each project is identified by a string of from one to nine 
characters* beginning with a capital letter or a digit* called a 
EC£±££± IQ* which is unique within the installation. 

Each user is associated with a project. The user is identified 
for access control purposes by the concatenation of his person ID 
and his project ID. A person may be registered as a user on more 
than one oroject' we consider him to be two different users in 
this case. 

Since the project ID makes up the second component of each 
user's access contr o I name.* permission to log in on a project 
confers the ability to reference certain segments. 

The list of persons who may log in on a project is contained in a 
segment within the Multics storage system. This segment is 
accessible only to the system and to the system administrator. 
The segment is known as a p rol ect de f i nl t Ion tab I e (odt) • There 



is one entry in the pdt for each user, which contains the user's 
attributes and usage information for the current month. 

Each project has an administrator associated with it. The 
administrator for a project may be the system administrator, or 
the project administrator may be some other user of Multics. 
Project administrators will receive monthly usage reports 
describing the activity of users of the oroject. 

A pro! ec t d Irecto rv is established for each project. This 
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directory is contained in the directory ">user_dir_dir M . It 



although the project administrator may specify some other 
am anqement . The project directory has a cj lsk q yot ai which 
limits the total amount of disk storage which the oroject may 
occupy* The project administrator may subdivide this quota among 
directories Inferior to the project directory* or he may elect to 
allow some or all of the directories inferior to the oroject 
directory to have a zero quota, and to charge their usaqe to the 
nroject directory quota. 

Each oroject is a member of a I oad cpn tro I group * which is a 
qrouoini of projects which share a guaranteed access to the 
system. Each load control group has a quota of "primary" load 
units *hich represents a quaranteed number of users from the 
grouo who will be able to log in. Users in excess of the grouo's 
quota will be allowed to log in If the system Is not full, but 
will be subject to p^eemotion by primary users from other groups. 
The oroject administrators for the Drojects of a group may 
cooperate to control who from the group may have primary status, 
and for how long. 

The lo^d control grouo feature can be used to satisfy large 
customers of the system, while protecting the small user's 
abllitv to be able to access the system. This feature of Muttlcs 
is optional, thought an Installation may simply put all users In 
the same group and byoass the facility entirely. 



usua I I y 




each user of the prolect, 
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The f o I I ow ing 
s true ture • 



figure is an overview of the system directory 



I roo t 



J >syst em_contro !_dir 

1 >scl 

I I 

\ \ 



I 



i 



ans wer_tab I e 

insta I I 3t ion_parms 

absen tee3 • ms 

sat 

ont 

>odt 

who tab 

I ines 

mgt 

stat_seg 
I og 




>SysAdmin 



I ibrary 

dia t uo_ 
new_user 



1 > Projl 
! 



admin 



J 



nro] file 
reqf 1 le 
ur f 
etc. 



I ib 



master. ec 

va I ue_seg 

sys_admin_data 

local installation programs 
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2.1 >syst em_contro I _di r 

The most important directory for the system-administration 
oroarams is the initializer's home directory, 

> s y s t e m_c on t r o I _d i r 

This directory, right off the root, contains those segments 
referenced by the initializer during the processes of 

1. Logging in a user 

2. Logging out a user 

3. Accounting for user usage 

**• Installing new system-administration tables 

5. System startup 

The contents of this directory include the following special 

segment s ? 



I ines 



sat 



the list of GIOC channels to accept dlalups 
and logins from, referenced at system 
st ar t -up • 

the System Administrators Table, containing 
an entry for each legal project plus some 
per-system quantities. This table is 
referenced at every login, to validate the 
user's project id. 



ins ta I I at ion_parms installation-defined constants, 

shift definitions and prices 



including 



ont 



the Person Name Table, containing the 
identification of all registered persons. 
This table is accessed at most logins, to 
determine the user's password. 



10 account ing 

st at_se g 
answer__tab I e 

who tab 

absen te abuser _ tab 



the 10 daemon accounting records, one 
per orint or punch operation 



•card' 



on-line system statistics 
accounting update 



sampled every 



a table which has an entry for each terminal 
line, with the name and accounting data and 
process id of the user logged in on it 

the public list of logged-in users 

the "answer table" for absentees 
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the absentee user Job queue for queue N 
a hash table for the pnt 

a message tyoed by the user process during 
the normal process startup 

a segment publishing the Initializer's event 
channel used to signal updates of 
system-control tables by administrators 

the initializer's log of events of interest. 
Hany initializer messages are tyoed to the 
operator and also recorded in this segment. 

a special segment giving sequences of 
commands which operators may be al lowed to 
execute as macro-operations. 

a segment which is tyoed if a user says 
"help" instead of "login" 

a table giving the guaranteed load units for 
each load control group and listing the 
groups" current occupancy. This table is 
accessed at each login to determine whether 
the attempted login would overload the 
system. 

In addition, other segments may be kept in >system_cont rol_dir, 
such as segments necessary for system reloads. 

There are two subdirectories of >syst em_c on t ro 1 _d ir which are 
important. The first directory, 

>sys tem_contro I _d ir >pd t 

contains a pdt for each legal project. Whenever a user logs In, 
his pdt entry is located in his project's odt, and the user's 
attributes are used to initialize his process. The usage data 
figures in these pdt's are updated while the system is running. 

The second subdirectory, 

>sys tem_cont ro I _d ir> inst a I I 

is used when an administrator requests the installation of a new 
cooy of a system table. 



absen teeN • ms 
ont .ht 

message_o f __the_ day 
pro J_admi n_seg 

1 og 

adm in . ec 

1 ogin_hel p 
master_gr oup_tab I e 
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2.2 >user_d ir_dir >SysAdmi n 

Another important directory is the system administration's 
project directory, 

>user_dir_d ir>Sys A dm in 

am the directories and segments Inferior to it. 



2.2.1 > us er_dir_dir>SysAdmln> admin 



All data segments pertaining to system administration should be 
Keot in a single directory inferior to >udd>SysAdmln. At MTT* 
this directory is called 

>u 1d >SysAdm in>adm in 

It contains the following! 

urf the user registration segment* giving names 

and addresses, and person I0 # s. This segment 
is used when a person is registered, to 
guarantee that his person 10 is unique at the 
ins ta I I at 1 on. 



ur f .h t 
req f i le 

pro J f i I e 



miscf i I e 
pm f . archi ve 

PNT.pnt 
ont .ht 



a hash table for this segment 

the requisition segment, containing account 
number, billing address* total charges, and 
requisition number for each usage account. 

the project segment, containing descriptive 
information about each project* including 
title, supervisor address* and disk storage 
usage. 

the miscellaneous charges and credits Journa! 

an archive of all pmf's for projects run by 
the system administrator 

a copy of the system pnt 

a hash table for this segment 



smf . cur 



the current smf This is converted to a sat by 
"cv smf" 
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smf .cur .sat 
disk__st at 

ins ta 1 I at Ion_parms 
I ines 
smf .new 

cutrD t 
sumry 

diskrepor t 



a cooy of the current sat 

a segment giving disk quota and usage for a I 1 
directories with ouota 

a backup copy of the same segment in 
>syst em_contro I _d ir 

a backup copy of the same segment in 
>syst em_contro l_dlr 

the next version of the smf, some commands 
make changes to this segment. AH changes can 
be put into effect by typing M new_smf" 

a report, showing accounts which are cut off, 
prepared daily 

a report of account status, prepared daily 

a report, giving project disk usage, prepared 
on request 



de I egated_pmf • archive an archive of all pmf's for delegated 

projects, giving the omf at the time of 

delegation. Changes by project administrator 
are no.t reflected. 



daemon_backuo. ec 



metered at a 



today .use_tota I s 



this segment becomes an "absin" segment at 
the end of the month which lists all daemon 
use 

a copy of the contents of 

>system_contro l_l>s tat_seg, made every day, 
for use In generating system statistical 
reoor ts • 

a statistical data base which describes 
month-to-date system resource availability 
and usage. 



yesterday .use_tota I s the previous day's cooy of today. use _tota Is. 

dai ly_raport. control a segment which describes which protects 

will be summarized under each category in the 
daily and monthly statistical reports. 



system. report 



the daily statistical report. 



o I dom f . ar ch i ve 



an archive of pmf's for deleted projects 
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PNT • ont n 
sm f ,o I dn 
da i I y_l og_H 

I og_se I ic t_f i I e 

suf f ix_l ist 

t er mse g 
ter muse i 



orevious cooies of the on t , In case of crash 

orevious cooies of the smf, in case of crash 

extracts from the system log* prepared for 
printing each day 

a segment which controls the program 

"da i I y_ I og_orocess" in its selection of 

messages from the log for daily printing 

a segment which controls the orogram 
"d t sk__usage_st at" in its selection of segment 
names to summarize 

a segment which fists terminals by terminal 
id code* used by "conso 1e_reoort" 

a segment which I ists the users of each 
terminal created by "cons o I e_repor t" 



Other data segments kept in this directory include backup copies 
of billing data for orevious months and other temporary segments. 
It is in this directory that the monthly bills and statistical 
reports are written. 



"Filled" and orocessed TO accounting segments and log files for 

the current month are kept in a special subdi rectory * 

>udd>SysAdmln>admin>history 



until the end of the month. 



Every night, the system_contro l__dir cooies of the sat and the 
odt's are copied into the directory 



>udd>SysAdmin>adm in>saf e_odts 



to oro\/ide backup billing data, The cooies are also used at the 
end of a billing period, to reset the usage charges in the system 
odt "s . 

Cooies of the usage totals, "orojfile", and "reqflle" for 
orevious months are keot in another special subdirectory, 



>udd>SvsAdmin>admin>HF 



for at least a month, so that the billing can be re-run i? 
necessary. These segments should be dumped to tape and deleted 
after a reasonable period. 
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2,2.2 >user__dir_dir>SysAdmin> I ib 

Those segments which are not sensitive* such as 
system-3dml nistrat ion programs not contained in the library* are 
Keot in a different directory. This facilitates dumping of these 
segments separately* and aids in the startup of new 
installations. At MIT * this second directory is called 

>udd>SysAdmin> lib 

This "accounting library" directory may contains 

master. ec the main exec_com segment for the 

admin istrat ion 

err.ec the exec_com segment invoked when errors 

occur 

biller.ec the exec_com segment invoked for billing 

sys_adm in_data the interlock to prevent multiple editing of 

the same segment 

value_seg a symbol-table segment which gives the value 

of certain constants used in the 
system-administration ope rat ions 

Installation-dependent system administration tools are also keot 
here. All system administrators should do a "se t_search_dlr" so 
that they use the programs in this library. 
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The following section Drovides ODerating instructions for the 
functions available to a system administrator. If the system 
administrator is operating in "restricted" mode* under control of 
"accoun ts_o verseer__" f then all he needs to do is type the 
function name followed by its arguments. If a system 
administrator is operating under control of the standard Hultics 
overseer, "orocess.overseer_ M , he must precede each command by 
the string "ec master", e.g., 



The examples given below assume that the administrator is 
restricted. Lines prefixed by "u)" are typed by the user and 
lines prefixed by "s) " are typed by the system. 



ec master tunc args 



* . . 
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add anon 



Operat 1 on t add anonymous user to project 
Command t add_anon 

Ll£iLQ£ ; This function adds an anonymous user to a 

non-de 1 agat ed prolect with given home directory and initial 
orocedure and (optional) oassword» 

£>ianiQia ? To add an anonymous user to the project "Prof 5", 

t yoe 

u) add_anon ProJ5 I I mi ted_ser v lce_syst em_ >udd>Prot5 
s) Warnino: anonymous user has no password 
s) r 1557 12.558 «f0*3i» 

s) Signal from System Control process? POT installed 
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bi I 1 



0££r aJLi o.n : 



run month I y bills 



bi I I 



operat i ons • 



This function calls "biller.ec" to aid in billing 



To preoare for billing, tyoe 



u) bill prepare 
To run the bills, type 

u) bill run 
To acceot a bill, type 

u) bill accept 
To clean up after the bills have been written, tyce 

u) bill de I e te 

See Chaoter k (page 57) for a complete explanation of the billing 



process • 
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chaddr 



Opar^t i pn i change person's mailing address 
Command * chaddr 

Usage t This function calls the "change" function to change 

a person's address* This function is used to change Just the 
address for a single nerson. It does not Install the PNT5 to do 
this* use "install PNT.ont" or do a regular change and answer 
yes. The address must be enclosed in quotes. If the address is 
not supplied* the old address will be displayed* and a change 
accepted. 

E-xamp I e t The address must be enclosed in quotes. To change 

the address for "Jones", type 

u) chaddr Jones "HTT 39-895" 
s) r 1557 12.558 £*t!+34 
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chal ias 



Ooerat i on i change oerson's atlas 
Com mand? chal ias (obsolete) 

Usage t This function has been removed from the system. The 

alias feature is not currently recommended, because we do not see 
a good way to implement it consistently. Design discussions are 
going on about the alias feature* and it will be either 
completely removed or fully supported. 
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change 



Oo^rat i ors : modify user registration data 



Camm an d ' 



change 



Usage, t This function is used to review and possibly modify 

user registration data In the urf and ont. Each item is tyoed 
out, and then the administrator may leave it unchanged by typing 
"no" or a carriage return, or replace it by new data. 



t yoe 



To change the default oroject for the user "Smith", 



change 

Enter userld 
Smi th 

I f you want to 
Otherwise type 
Name • 

Address : 



change any item, type the new data, 
"no" or hit carriage return. 
Smith, John 



Programmer number! 

Pro feet: 
Physics 

Change password? 
no 

More users to change? 
no 

Ins ta I I now? 
yes 

Installing new pnt. 
Installation completed, 
r 1557 12.558 *f0*3*+ 
Signal from System Control 



MIT 3-001 



1234 



Quark 



process? PNT installed 



Notes ' 

then a comma, 
followed by 
also all owed, 
title should 
colon, as in 



The user's name should be given last name first, 
then first name, a space, and middle initial 
a period. Names of the form "Smith, 

If the user has a title, such 
follow the name and be separated 
Smith, John J.SProf.". You may 



J. Alfred 
as "Prof.", 
from the name 
type "stoo" at 

time to abort all the changes you have made to a ©articular 
anl start over. In response to the query "Change password?" 
may answer "yes" and then give a new oassword, or 



are 
the 
by a 
any 
user 
you 

verify" to 
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change 



check that you have the correct password* or w no" to leave the 
password as is. The last name may be up to 32 characters long. 
The first name and middle initial field may be up to 2h 
characters. The address field may be up to 32 characters total? 
use slashes to seoarate lines of address. The programmer number 
and title may each be up to 8 characters long. 
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chdf_pro 1 



Qssra t } on, : change person's default project 
Command* chdf_oroJ 

Usage * This function cat ts the "change" function to change 

a oerson's default project. This function is used to change Just 
the default oroject for a single oerson, It does not install the 
PNTJ to do this* either type "install P NT • Dnt " or do a regular 
change and answer yes. If the default oroject is not currently 
in the oroject segment, a warning message will be orinted. If 
the default project is not supplied* the old value will be 
displayed^ and a chancje accepted. 

Tf the user has changed his own default project, with the 
"-chanqe_de f au I t_pro J ect" argument to login, this change will not 
be effective. A soecial tool Is available to unrestricted system 
administrators to force the change of a default oroject? this 
oroqram is called "pass_util". 

£.&2mgJ_e_* To change the person-id "Smith" so that his default 

project is "ProJ3", type 

u) chdf_orol Smith ProJ3 
s> r 1557 12,558 **0+3^ 
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check_l oq 



afisr.atio.ni 
Command : 



check log for info on user 
check_l og 



Usage i Sometimes a user will comolain that he can't log in. 

To finj out why, you can scan the log segment for the messages 
placed there by the initializer which give the reason. 



To see why "Jones** can't log in, type 



u) check__log Jones 

s) 702 09/22/71 1333.2 0 lg__ctl_? no I Jones. Mu 1 1 i cs 27 kl 
022 chn tty302 reason bad_pass 
s) r 1557 12.558 <f0 + 3<f 

This message says that the user could not log in becuase he gave 
the wrong password. His terminal ID was 022, and his channel was 
tty302. This message has severity 0 (so it was not typed to the 
ooerator, Just logged), and is the 702nd entry in the current 
I oq . 

The following is a list of reasons for not logging a user in: 
bad_pass bad password 

badpers person not in pnt, either not added or mistyped 
no_name no name given 

pwlocked password locked by administrator 

bad_proJ project does not exist In sat. may be mistyped 

no_pdt project's odt is not in >scl>odt. message with 

stars also tyoed online 
not_pdt user not in pdt for project, did you forget to do 

an "upmf?" 
anon_pw bad anonymous-user password 

already user already logged in, and no "multip" f I aa 

(absentee does not count) 
no_acct no default account 10 

acct_.no project's account out of funds or past termination 
date 

hd_path bad oath name for home directory 
hd_nodir what should be home directory Is ncn-dir branch 
h1__err some error in getting status of home directory 
hd_make error creating home directory branch. message in 
I og 

hd_where home directory missing, does not seem to be below 
project dir. we will not create. 
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sys.ful I system full according to load units 

saturate system full according to max. number of users 

cant_bum system full* user cannot find anyone to bump 

groupmax load control group at absolute maximum 

no_grouo load control group in sat not in mgt 

nf_nosec system not full* grouD f ul I* no secondary 

sysgrpfl system full* group full* cannot bump 

orog_err programming error in !g_ctl_ 
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Qoer^t lo_n * change person's mailing name 
Command i chname 

Us^a& : This function cal Is the "change" function to change 

a oerson's mailing name* This function is used to change )ust 
the name for a single oerson. It does not install the PNT? to do 
this* use "install PNT.pnt" or do a regular change and answer 
yes. The full name must be enclosed in quotes. If the name 
argument is not given, the old name will be displayed* and a 
change accepted. 

f;xamp I e t The name must be enclosed in quotes. To change the 

mailing name for the person-id "Jones"* tyoe 

u) chname Jones "Jones»H. Alfred" 
s) r 1557 12.558 ^Q + 3<* 
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Qperg t i an t change person's Dassword 
Qom.iiia.nd J choass 

Usage s This function calls the "change" function to 

change a person's password. This function is used to change the 
oasswori for a single oerson, It does not install the PNT? to do 
this, either tyoe "install PNT.ont" or do some other change and 
answer yes. This function can also be used to verify a person's 
oassworj, Answer "v" or "verify" to the first auestlon f and the 
program will ask for a oassword. If the password you give 
matches the person's password, the command will tyoe "ok". 
Otherwise, the command will type "wrong" and ask if you want to 
change (or try again to verify) the password. 

If the user has changed his own oassword* with the 
"-changa_password" argument to login* this change will not be 
effective. A special tool is available to unrestricted system 
administrators to force the change of such a passwords this 
Drogram is called "pass_util". 

5 ^a, mp LS ! To change the oassword for the oerson-id "Jones" f 

t yoe 

u) chpass Jones 

s) Change password? 

u) yes 

s) Password: 

u) newpass (the Drinter is turned off* 

s) r 1557 12.558 <fO + 3i* 
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chor og 



Operat ion t change person's programmer number 



Command t 



chprog 



a person's 



This function calls the "change" function to change 
programmer number* This function is used to change 
Just the programmer number for a single person. It does not 
install the PNT? to do this* either type "install PNT.ont" or do 
a regular change and answer yes. The programmer number must be 
all numeric. It may be up to 8 characters long. Some 
installations use the "man number" assigned by the company in 
this field. If the programmer number is not supplied* the old 
value will be displayed and a change will be accepted* 



£x amp I e ' 
"Smith", type 



To chage the programmer number for the person-id 



u) chprog Smith 7399 
s) r 1557 12.558 **0 + 3<* 
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cu 



Opera t i gp t create user directory 



Qomma.nd s 



cu 



Usag^t This function is used to create a user's home 

directory. Home directories are created when the user first fogs 
in, and the "upmf" function calls this function, but in rare 
cases* it may be necessary to execute this function seoarately. 



E xamo I e : 



To create the home directory for "Jones-Gamma", tyoe 



u) cu Jones Gamma 

s) r 1557 12.558 *»0f3«* 
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day, dayok 



Command : 



orint daily billing output 
day, dayok 



Usaoe I Every night, a se I f -resche du I i ng absentee Job called 

the "crank" runs which does the daily charging of users and 
checks for users who should be cut off. 

The "day" command prints the output from the crank on the 
console, and asks whether or not to delete the output. The 
"dayok" command Just asks whether to delete the output. Unless 
th^re was an erro", the absentee output segment should be 
de I eted. 



£x a male. * 



The output from the crank should look like this? 



day 



Absentee user Accountant.SysAdmin logged in ... 
r 0330 12,558 *t0 + 3<+ 

ioacur - 731 cards, 20 charged, 708 previously collected, 
next period. 
Total charge? 3*t5.67 

Begin charging for 7/31/71 2355.0 to 8/9/71 23*f5.i 
cut 3, warned 7, total charge $^5678.90 
r 1557 12.558 <f0 + 3*f 

Absentee user Accountant. SysAdm in logged out ... 

Del ete? 

yes 



See section 5.3 (page 63) for a complete explanation of the dally 
orocess ing. 
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Doer at i, an s give project to oroject administrator 
Command t delegate 

Usage s This function is used to give a project 

administrator control over a project's omf. Once this is done* 
the project may add and delete its own users* and set 
resource-usage limits on users in the project. 

The command moves the project's pmf from "pmf • archi ve" to a 
specified directory (keeoing a spare copy in 

"de I egated_pmf .archive") » edits the smf to show that the oroject 
administrator may install pdt's for this project* and sets access 
on "pro ]_admin_seg" and ">sys tem_contro l_dlr>update" so that the 
administrator may install his pdt. 

A delegated project is under control of the project administrator 
only. The system administrator will receive an error message if 
he attempts to execute the "dpmf"* "upmf"* or "pmf" functions on 
a delegated project. Use the "undelegate" command if you wish to 
take a oroject back from a project administrator* either in order 
to hava it controlled by the system administrators again* or so 
that it may be delegated to some new user. 

Examp I e s To give "Jones .Gamma" control of project "Beta"* 

placing the omf in ">udd>8eta"* type 

u) delegate Beta >udd>Beta Jones.Gamma 

s) archive: 8eta appended to de I egated_pmf . archi ve 

s) $ do a "new_smf" 

s) r 1557 12,558 i* 0 4-31* 
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d isk__repor t 



Qperat i on I write disk usage report 
Command, ; disk_reoort, dro, disK_auto 

Usage t This function is used to calculate a disk usage 

report. The administrator may type "disk_r eport" to cause a 
manual disk usage calculation. Normally, though, disk usage is 
done automatically every night by the absentee lob "dodro", which 
executes the "disk_auto" function. (See chapter 5 for details on 
how the absentee use is managed.) 

The program "sweep" is used to get quota for all directories into 
the data segment "d 1 sk__s t at*'. The program M charge_di sk" then 
charges these usage figures to projects in their "projfile" 
entries, A printable segment, called "diskreport", is produced 
but not automatically printed. To print cooies of this segment, 
tyoe "rim diskreport". 

5xa mo I e t To run a disk report, type 

u) disk_report 

s) $ Creating disk usage report. 

s) $ Following figure is total quota/current use 
s) 75500/6^32 

s) Charged 906 directories out of 910 to 108 projects 
s) r 1557 12.558 ^0+3^ 
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dom f 



Opara t j on * remove user from project 
CoJUmaUSi * dpmf 



U^age ? This function deletes a user from a project master 

file for a project which is managed by the system administrators* 

£x amp I e t To delete user "Black" from project "Gamma"* type 

u) dpmf Gamma Black 

s) r 1557 12.558 *»0 + 3<f 

s) Signal from System Control process? POT installed 
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doro J 



Ooerat i pn i delete project 
£ojamaj2d: doro J 

U sage 1 This function Is used to delete a project. It edits 

the smf to remove the project entry, calls "epro" and "erf" to 
set the date off fpr the oroject, moves the omf for the project 
to "o I dom f • archive" in case it is ever needed again, and calls 
deletedlr to delete the oroject directory and all of its 
contents. 

Examp I e * To delete project "Delta*", type 

u) dproj Delta 

s) archive? Delta added to oldomf .archive 
s) type 
s) type 

s) dd? do you want to delete the directory >udd>Delta?? 
u) yes 

s) $ do a "new_smf" 

s) r 1557 12.558 <*0 + 3<f 

Notes t If you answer "yes" to the question about deleting 

the directory, the project directory and all segments and 
directories inferior to the project directory will be deleted. 
The project will be charged for disk usage until the project 
directory is deleted. If you answer "no", the project's 
directory and segments will not be deleted, and the project will 
continue to accumulate storage charges. Do not answer "no" 
unless there is some exceptional reason for doing so, since the 
project directory will have to be deleted later by an 
unrestricted system administrator* 
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instal 1 



Operate ons install system table 
Command i instal I 

Usage s This function is used to install a system table. It 

can be used when the table has already been converted* in case a 
oravious installation request failed due to a crash. 

Examp I e t To install the current pnt» tyoe 

u) install PNT.ont 

s) r 1557 12.558 **0 + 3<* 

si Signal from System Control process* PNT installed 
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ison 



Opera t i on : see if person is registered 



Command s 



ison 



U sage : This function types "true" or "false" depending on 

whether a person is registered in the ont or not. It then lists 

all users in the user registration fife who have a last name 
which matches the argument. 

To check whether the user "Jones" is registered* 



u) ison Jones 

s) true 

s) Userid for "Jones, Herbert R." is "HJones" 

s) Userid for "Jones, Peter" is "Jones" 

si Userid for "Jones, W. Alfred" is "AJones" 

s) Number of users with last name "Jones" is 3 

s) r 1557 12.558 <f0+3*» 
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1 abe I s 



Command : 
of f 1 ine . 



print ma i I ing I abe Is 
I abe I s 

This function prints a set of mailing labels 
To run the labels, type 



u) I abe I s 

si r 1557 12.558 ^0+3** 
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misc 



Qpe rat i on i orocess charges and credits 
Qommgnd * misc 

Usage s This function is used to input miscellaneous charges 

and credits. For each transaction, the project 10, the amount 
(negative for a credit), and an explanation are required. Each 
transaction will result in a separate line on the monthly bill. 
The transactions are stored In "miscf i le", and the total is also 
placed in **pr o J f i I e". All three input items for a transaction 
may be put on the same line, or they may be supplied one at a 
time. The program will indicate the type of Iten? to be inout 
next. Typing "x" instead of a project ID exits from this 
f unct ion. 



Ex^mpJLs. 


8 To credit project 


oro J ect 


"Beta" for some manuals 


u) 


m isc 


s) 


pro J 


u) 


A Ipha 


s) 


amt 


u) 


-10.55 


s) 


exp 1 anat ion 


u) 


system crash 6/23 Jones 


s) 


oro J 


u) 


Beta k. 50 Manuals Smith 


s) 


pro! 


u) 


X 


s) 


r 1557 12.558 **0 + 3*f 



"Alpha** for a crash, and charge 
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Qperat ion s add new project 
Com mand ? new_proJ 

Usage ? this function is used to add a new project, 

Examp 1 e s To add new project "Gamma", giving the user 

"Fooch. Gamma" project administrator status U • e. write access on 
the project directory - the project is not delegated) , and 
setting an initial quota of 100 records* type 

u) new_proJ Gamma Fooch. Gamma 100 

s) archive* Gamma aooended to pmf. archive 

First, the system asks for the project title. This field should 
be a short description of the purpose of the project. It may be 
up to 52 characters long. 

s) type type title 
u) Gamma Ray Research 

Next, the system asKs for the name and address of the principal 
investigator. This is the individual to whom the usage reoort 
will be addressed. Both name and address may be up to 32 
characters long. 

s) 1 nv 

u) Prof. Q. X. Jones 
s) inv_addr 
u) HIT 39-895 

Next, the system asKs for the name, address, and telephone of the 
oroject supervisor. This is the individual In direct contact 
with the project's day-to-day activities. He may be the same 
person as the princiDal investigator, or he may not. Often, he 
is registered as a user or project administrator for the oroject. 
The name and address may each be up to 3? characters Jong. The 
telephone number may be up to 16 characters long. 

s) sup 

u) Mr. Melvin Fooch 

s) suo_addr 

u) MIT 39-896 

s) suo_phone 

u) MIT xl?3*f 
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new_pr oj 



At this point* the system has finished adding the project to 
"prol f 1 le M . You are now asked if you wish to review and correct 
the entry (by typing "o M and then perhaps "c") or i f you wish to 
continue with the registration procedure (by typing "fife"). 



Now* the system adds an entry for the project to the requisition 
file* "reqflle"* first asking for the external account number and 
requisition or purchase order number, 

s) type account 

u) 11792 

s) req 

u> 123t>56 

The system next asks for the cutoff limits for the project, The 
funds limit Is a dollar amount (enter M 0 M to show an "open" 
amount! • The date cutoff limit is a date* expressed as either 
"mm/dd/yy M or "mmddyy". If the project exceeds either of these 
limits* all users on the oroject will be prevented from logging 
in, but the project will continue to Incur disk and registration 
charges until you delete the project. 

si funds 
u) 0 

s) cutoff 
u) 7/30/72 

Next, the system asks for the name and address to which charges 
incurred by the project should be reported. The name and address 
may each be up to 32 characters long. 

s) name 

u) Fiscal Office* Attn? L. Soottswood 

s) addr 

u) MIT 1-101 

At this point the project has been added to the requisition file. 
You are now asked whether you wish to review and edit the entry 
(by typing "*p" and perhaps "c") or if you wish to finish 
registering the project (by typing "file"). 



s) type 
u) file 



s) type 



Multics System Administrators Manual Page hi 

111/09/73 rev 3 

Chapter 3 Administrator Commands 



new_oro 1 



u) file 

s) t do a "new^smf" 

s) r 1557 12.558 **0 + 3** 
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new smf 



Operation I convert smf to sat and insta!! 
C gmmg nq' ? new_smf 

U?age t This function is used after any change is made to 

the smf. It converts the smf to a binary sat* reruns 
"da i I y_summary" to insert cutoff codes* and requests the 
initializer to install the new sat. Those functions which make 
changes to the smf will remind the administrator to do a 
M new_smf M . Since this function is t Ime-consum i ng» it should be 
done at the end of a bunch of changes. 

u) new_smf 

s) r 1557 12.558 W+3^ 

s) Signal from System Control process! SAT installed 
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Q£.2E.£±io.n : Edit and convert nmf, install odt 

C.2!H!]iaD.J ? prof 

Usiget This function is used to do arbitrary editinq of a 

omf. It throws the administrator into the aedx editor after 
reading in the segment, and allows him to make any changes he 
wan+s. Because aedx is comolicated to learn, this function is 
not for beginners. After the administrator exits from qedx, the 
function converts the omf to a odt, and signals the initializer 
to ins+all the omf. The function takes care of uodating 
M om f . arch i ve" as well. 

^xamoie.* To edit the segment "Opera tor • pm f •% type 

u\ omf Operator 

s) Edit. 

u) (editing commands) 

u ) w 

u) q 

s) r 1557 12,558 U0 + 3<f 

s) Signal from System Control process? °0T installed 
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pro J_mtd 



month-to-date report 
pro J_mtd 

Usa ge t This command types a month-to-date report for any 

project's usage. The report lists all users on the project and 
their dollar totals, as well as disk and miscellaneous charges. 

E xamo le t To get a report of the usage for project "ALPHA'S 

type 

u) proJ_mtd ALPHA 

si Month to date for proj ALPHA 




s) 


Name 


logins 




charge 


s) 


White 


11 


$ 


133. «>i 


s) 


Brown 


0 


$ 


0, 00 


s) 


2 users 


11 


$ 


133. 


s) 


registrat ion 




$ 


20.00 


s) 


mlsc 




$ 


0.00 


s) 


disk 




$ 


176.08 


s) 


Total 




$ 


329. *f9 



s) r 1557 12.558 ^0 + 3** 
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reco v 



Qperat j op t generate nmf from pdt 

nominally 5 recov 

U£3..9£ ? This function is used if a project's PMF is 

destroyed* The function generates a new PMF from the system's 
binary POT. 

E.x a.£LD_±e_ s Suopose the project "ProJ2" loses its pmf. To get a 
new one, type 

u) recov ProJ2 

s) r 1557 12.558 kQ+tk 
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regi st er 



Operation t 
Command? 



Register new person 
register 



Usage t This function is used to register a new person-id. 

It enters him in the "urf M and in the "ont". If a person is 
already a user of Multics* or if he was once registered and was 
not removed* this function should not be used since the user will 
still be in the urf and ont . 

Enter "stop" at any time to abort the processing of the current 
user, for instance if you have misspelled his last name* or if he 
is already registered, 



Example* To register a user* the dialogue goes like this! 

u) register 

s) Enter full name (Last, First I.) 

u) Smith, Robert M.fProf. 

s) Enter mailing address 

u) MIT 39-575 

si Enter programmer number or "none" 

u) 6789 

s) Enter default project 

u) Language 

s) Password: 

u) wugga (the printer is turned off) 



The system will attempt to generate a unique person ID for the 
oerson being registered, by trying first his last name alone, and 
then his last name prefixed by his initials. If either of these 
guesses succeeds, the system makes a tentative assignment and 
asks if the person 10 is acceptable. If neither of the guesses 
succeeds, and if you reject the system's guess, the system will 
ask you to specify a person ID* and will then check to make sure 
that the ID is unique. 

s) Userid "Smith" is already used by "Smith, Frank X." 

s) Trying "RMSmith" for userid. 

s) Userid assigned is "RMSmith" 

s) Is this ok? 

u) no 

s) Please suggest a userid for "Smith, Robert M." 

u) RSmith 

s) Userid assigned is "RSmith" 
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s> Is this ok' ? 
u) yes 



Administrator Commands 



register 



At this ooint, the user has been added to the user registration 
file and the PNT • You may now add more users* or if you are 
finished registering users* you may install the PNT immediately 
or later. 

s) More users to add? 

u) no 

s) Instal I now? 

u) yes 

s) Installing new ont. 

s) Installation completed, 

s) r 1557 12.558 ^0+3^ 

s) Signal from System Control process* PNT installed 
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rename_pro J 



O o^rat i on l 



rename project 



C omman d ! 



rename_pr o J 



This command is used to rename a project. 



Example* 



To rename project "AAA" to M B38", 



type 



u> rename_proJ AAA 88B 

s) Now do a *new_smf* and then a 'prnf 888* 

s) also change default project for users on 888 

s) r 1557 12,558 i*Q + 3k 

u) new_smf 

s) r 1557 12,558 <*0 + 34 

s) Signal from System Control Process! SAT installed 

u) prnf 888 

s) Edit, 

u) q 

s) r 1557 12.558 kG+3h 

s) Signal from System Control Process? PDT installed 
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r qm 



Qp^rat I on t request statistics to be printed 

Command? rqm 



'J^^ge i This function requests the dprinting of a report for 

all administrators. The single argument is the name of a segment 
to be dorinted. 

SLxsmjilaS To send a copy of the disk usage report to all 

administrators* type 

u) rqm diskreoort 

s) r 1557 12.558 kQ + m 
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setcrank* setdisk 



Operation s Schedule absentee Jobs 



Commands* 3.3** setcrankt setdisk 

Us/age, s These commands do the initial schedul ing of the 

absentee Jobs described in chapter 5 (page 62) which perform 
daily accounting. Unless the absentee Jobs crashed or the 
absentee Job queues were lost* there is no need to execute these 
commands. to check whether a Job is scheduled* type 

lar -aueue 1 -long 



If the Jobs "dodrp" or "crank" are not scheduled* execute 
"setcrank" or "setdisk" as appropriate* 
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undel egate 



QgftC.g.t Ion : Undelegate a project 

CammaQj3 ! undelegate 

Us^ge. ' Execute this command if you have delegate a prolect 
to some user, and wish to regain control of it or delegate it to 

some other user. 

£xamp_le. * To change the project "BLAH** from control by 

Smith. RLAH to control by Jones, BLAH, type 

u) undelegate BLAH 

s) archive! BLAH appended to pmf.archlve 

s) $$$ do a new_smf 

s) r 1557 12.558 <f0t3f* 

u) delegate BLAH >udd>BLAH>Jones Jones. ^LAH 

s) archives BLAH appended to de I egat ed_oro f . archive 

s) $$t do a •new_smf* 

s) r 1557 12.558 i*0 + 3<* 

u) new__smf 

s) r 1557 12.558 i*Q + 3i* 

s) Signal from System Control Process: SAT installed 
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Qo erat i on t add user to oroject 
Command i uomf 

Usage s This function adds a user to a oroject. It is used 

only on projects which are not delegated. The function extracts 
the oroject's omf from "om f . archi ve'% edits the pmf to add the 
new entry, converts the omf to a odt, signals the initializer to 
install the pdt, and replaces the edited pmf in "pm f . arch i ve". 

E xamo I es To add user "Jones" to project "Gamma"* type 

u) upmf Gamma Jones 

s) r 1557 12.558 t*0+3<* 

s) Signal from System Control process* °DT installed 
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Other commands 



other commands 

eoro, erf, mail, help, logout, status, 
llstacl, listcacl, lar, car, mq, go 



Ll£3S£ s Consult the MPM and the H^M S^S for details on the 

us^ge of these commands* A short explanation of each follows. 



car 

er>r o 
er f 

he I p 
I ar 

I is tac \ 
1 is tcac I 

I ogout 
mai I 



cancel absentee reauest. Use this function 
if an absentee Job is scheduled too many 
times by mistake, 

edit "pro! file". Use this function to change 
a project's supervisor name, title, etc. 

edit 'Veqf lie". Use this function to change 
a project's account number, requisition 
number, funds, cutoff date, etc. 

getquota. Use this function to print a 
directory's disk quota and usage. 

print information on command usage* 

list absentee requests. Use this function 
(usually with the "-q 1" argument) to list 
your absentee requests. 

list access control list. Use this function 
to check accessibility of a segment. 

list common access control list. Use this 
function to check accessibility of the 
contents of a directory. 

log out from Multics. 

read or send mail. To read mail sent to you, 
t yoe 

ma 1 1 

To send mail to some other user, type 

mail * Person Project 
and then type your message, ending with a 
line consisting only of 
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Other commands 



mq movequota. Use this function to shift quota 

to a directory from its superior. 



s taf us 



print information about a segment. Use this 
function to see when a segment was created. 
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The following is a short explanation of the monthly billing 
process and the information used in monthly billing. 

The most important thing to remember is that the monthly billing 
process consists mostly of a print pass over the saved PDT's and 
a print pass over "reqf ile". Other information is also taken 
from "orojfile", "miscfile", and "bi 1 1 lng_f ootnote". No pricing 
out of usage is done during the billing process? this has all 
been done during the daily Drocessing. 



Outout from billing 
The reports output from the monthly billing process are* 

1. long_bill - this report is a complete breakdown and 

Justification of charges for each oroject. For each 
project, the bill will have from one to four sections? 

a) charge summary* by user 

b) Interactive usage, by user 

c) absentee usage, by user 

d) I/O daemon usage, by user 

In addition, the charge summary shows the oroject's 
disk and miscellaneous charges, lists the current 
orices, and may have a footnote intended as a message 
to all project supervisors. 

2. short_blll - this report consists of just the charge summaries 

from the long bill. The prices 'and footnotes are 
suppressed. An elaborate grand total oage is printed. 
This report is intended for the use of system 
administrators and facility directors, who find the 
I ong bi 1 I too bul ky • 

3. bill - this report is a listing, by account number, of the 

charges made to each account. One line is printed for 
each Droject, showing the charges this month and the 
charges to date, face amount, and requisition balance. 

k* msum - this report is the monthly summary. It has one line 
per requisition or purchase order, and gives the same 
information as in "bill". 

5. cards - at the HIT installation, this deck is punched for 
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transmittal to the MIT Genera! Accounting Office. The 
program "pun ch_MI T_deck" oroduces this segment. The 
peculiar format of the cards and the many agl hoc 
decisions in the code are the result of the accounting 
office's requests. 

It is expected that other installations will remove all 
mention of this program, if they don't need any 
external record of charges* or that they will insert 
some local program which may or may not produce cards 
in place of "ounch_MIT_deck M . 

6. miscs. print - this is a listing of all miscellaneous charges 
and credits for the month. 

ft. dback - this report is the result of an absentee Job 

fabricated by the billing process and run later. It 

lists every daemon session during the month in 

chronological order, and shows, for each session, who 

used the daemon, how much he used, and what shift and 
aueue he used. 

9. syst 3m_month. report - this segment gives a summary of Muttics 

usage for the billing period. 

10. diskreport - this report shows each project's disk usage for 

the month. It also has a map of every directory in the 
hierarchy which has a disk quota, giving its current 
usage, its charge for the month, and its quota. 

11. conso I e .reoor t - this report shows the usage of each 

terminal, sorted by terminal ID. For each user who 
used a given terminal, the total connedt time during 
the month and the number of logins is shown. 



k,2 Inputs to bill ing 

The input segments to the billing process and what of their 
contents is used are listed below, 

1. PDT's - the copied odt segments in 

>udd>SysAdTiin>admin>saf e_pdts contain the complete 
usage data for each user for the billing oeriod. 

2. pro] file - this segment is used mostly to get the disk usame 

figures, which are stored there when a disk report is 
run. The project title and the name and address of the 
project supervisor are also used to create headings on 
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the long and short bills. 



3, reqfile - this segment has the charges which are actually 



billed. Daily processing has updated "reqfile" from 
the figures in the PDT's* so the two should agree. (An 
error comment is printed if they do not* and the 
"reqfile" values are used.) The name and address of 
the person in charge of the account as well as 
requisition numbers* amounts* and cutoff dates are also 
extracted from this segment. 



k* miscfile - this segment is the Journal for miscellaneous 



charges and credits associated with a project. On both 
the short and long bills* all entries for a particular 
project are located in this segment end re-printed. 
(If the total of charges and credits in "projfile" does 
not match the total from adding the individual entries 
in "miscfile"* an error comment will be printed and the 
total from "miscfile" actually billed.) 



5. bi 1 1 ing_f ootnote - this segment is optional. If present* all 



the text in it will be printed at the bottom of each 
project's usage summary. This segment can be used to 
announce forthcoming price changes* or make other 
announcements to the administrators for each project. 
It is printed on the long bill only. 



6. disk^stat - this segment Is used in the preparation of the 

disk report. 

7. today . use_tota 1 s - this segment is used in the preparation of 

system_month . report. 

8. The accounting segments saved in the subdirectory "h" are also 

used in the preparation of "dback". 
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<+. 3 Steos in bill inq 

The o^ocedure for oreoaring a bill consists of three parts* 
preparation, actual runninq-off of the output* and cleanuo 
operations once the bill is Judged correct. 

The o^epar at ion ohase consists of checking for sny un-orocessed 
dormant accounting segments* and checklnq to see that a disk 
renort has been run recently. 

bill prepare 

does most of this. The administrator should also make sure that 
the segment M bl II lng_f ootnote" is up-to-date, and that all 
miscellaneous charges are input. The administrator may run a set 
of mailing labels at this time. 

The actual running of the bill is initiated by typing 

bi I I run MM DO Y Y 8XXXXX 

where MM/DD/YY is the date of the last day of the month. The 
arqument BXXXXX is used by , *punch_MIT_deck M - other installations 
will probably reolace this argument with others more appropriate 
to their needs. 

The "run" processing prepares all of the above reports and bills. 
It dorints one copy of the bills In the highest aueue before 
starting on the usage summary report. 



As soon as the administrator has examined 
and found no gross errors * he may type 

bill accept MONTH 

which causes the following! 



his copy of t he bill 



1. dorinting of many copies of the billing output and reports. 

The addresses for these reports are obtained from 

"\/a I ue_seg". This dorinting is done by the "rqbiM" 
f unc t i on. 



2. Submission of absentee lobs to 
"conso I e. reoor t" and "dback". 



create the output reports 



3. Copying of the segments used to create the bill into the 
directory HF. The names of these segments are orefixed by 
the MONTH soecified as an argument for example* "reqfile" 
is copied into "HF >M ONTH , reqf i 1 e M • 



Multics System Administrator's Manual Page 61 

01/09/73 rev 3 

Chapter *f Ri 1 I i og 



Resetting of the various data bases for the next month. The 
proqram "reset_us age" is run to subtract the user usage 
figures in the copied odt's in >udd>SysA dmin>admln>saf e_pd ts 
from the usage figures in the pdt's in 

>sys tem_contro I _dir>odt , so that the month-to-date usage 
totals will start over for a new month. The program 
"uo_ctr" is also run, to add the "charges this month" field 
in "reqfile" into the "charges this requisition", and reset 
the "charges this month". Any entries in "reqfile" or 
"orojfile" which are marked as having been deleted during 
the month are then deleted. 

5. Resetting of the disk meters in the directory branches. The 
program "rese t_di sk_me ters" Is used to subtract the value of 
the t ime-oage-oroduct integrator used for charging (stored 
in "di sk_s tat") from the value in the branch. 

Once the bills have been mailed out, and everybody who should 
have a copy has got one, the administrator should delete the 
bills from the disk by tyoing 

bill delete 

The amount of storage required by the bills will vary, of course, 
deoending on the number of users registered on the system, and 
the number of sessions used during the month. It may come to 
several thousand disk records. Be sure to have enough quota 
before starting the billing run. 
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The daily billing and statistics are produced through the agency 
of two absentee Jobs which run every night, and which re-schedule 
themselves to run again the next night. The first lob is the 
disk storage accounting. The second is the actual 
accounting-segment update run. Roth Jobs oroduce reports which 
are dorinted for the system administrator.- 



*>•! Use of Absentee 

The disk accounting Job is controlled by the command segment 
dodr p. absin 

This Job executes only one command, namely "disk_auto" and then 
logs out. 

The accounting-segment update run is controlled by the command 
segment 

crank, abs in 

which also executes only one command, namely "crank", and then 
logs out. 

Each Job reschedules itself in Queue 1 for* the next night, by 
executing the "enter_abs_request" command to re-submit the Job, 
The time at which the Job is scheduled is kert in value_seg, 
under the variable names "crank__t i me" and "disk_time". The disk 
report should run before the crank, in order to charge the most 
uo-to-date disk figure to the users. 

The disk report Job is restartable, so that if the system crashes 
during its run, it will be rerun. 

The crank Job cannot be restartable. If the system crashes and 
segments are reloaded, users might be double-charged or not 
charged at all for* some usage, (See chapter 10, "Crash 
Recovery", for more information*) Therefore, the crank Job is 
marked not restartable, and furthermore the variable 
"abort_cr ank" in value_seg is used to stop the crank from running 
again, if it crashes. When the crank is about to enter its 
critical region, it sets "abort_crank" to "true". When it passes 
the critical region, it sets "abor t_crank" to "false". (Some 
parts of the Job, those dealing with summaries and so forth, need 
not be orotected,) When the crank first starts up, it checks 
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abor t_cr ank", and if it is "true" it immediately logs out. 



5 m ?. Disk reporting run 

See the writeuo of "disk_auto" for details on what is done by the 
disk reoort inq run. The important result of a disk reporting Job* 
from the noint of view of charging* is the storing of current 
disk usage figures in the segment "projflle**. These figures will 
be picked uo by the accounting update Job later and used to 
charge the project for disk usage. 



5,3 Daily accounting run (crank) 

The "crank" Job executes a command of the same name in master. ec. 
This command performs the follwoing stepst 

I. reschedule the crank for tomorrow 

?, process all 10 daemon records in 

>svstem_control_dir>io accounting which have not yet been 

processed and which have been completed. Call 
char ge_daemon_usage to add this usage the the aporooriage 
POT entries in >s yst em_contro l_d ir >odt • 

3. make a backup copy of the answering service version of 
the ont. 

k* call odt_cooy to cooy all system pdt's into safe_odts 

5. run "comout e_b i I I " to charge user usage, from the odt's* 
to the appropriate entries in reqfile. 

6. run "da i I y_summar y" to write a report giving account 
status and to modify the sat to cut off projects which are 
out of funds. 

7. install the new sat. 

8. run "da i I y_ I og_orocess" to prepare log extracts for 
system programmers and administrators. 

9* run "copy_as_me ters'% "print_met er s"» "syst em_tota 1 '% 
"usage_total", and "system_da i I y_r epor t" to prepare a system 
statistical report. 

10 . dprint cooies of the ouput reports. 

II. check for the existence in >sys te m_cor t ro l_dir of any 
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data segments which need processing. 10 accounting files 

and logs are processed automatically. Answering service 
dumps are automatically printed. 

The Job sends a message to the system administrator reporting 
successful completion via the "send_message" command when it is 
a I I done. 



5.** Daily operation 

Every day* first thing in the morning* the system administrator 
should read the output from the crank. If it has not been 
dorinted because of a system failure* or because the output is 
lost, the administrator should log in and type "day" (see the 
write-up of "day" in chapter 3* page 32) to see the output. If 
everything ran correctly* the administrator merely replies "yes" 
to the "Delete?" question and logs out. If the output has been 
dorintei successfully* the administrator can avoid having it 
tyoed again on the console by executing "dayok" instead. 
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New_proJ is the too! for adding a new project. You will want to 
Know the foil owing s 

Suoerv isor 

User list (must have at least one user) 

account, requisition numbers 

funds 

termination date, 
bi I I ing address 

delegated 0 if so* what user id and what directory 
initial quota 

The project 10 can be the same as a person ID i f you want. 
Projects which have been deleted and then return are a problem! 
try to avoid this. 

The sequence for adding a new oroject is* 

1. new_oroJ (see page *+i) 

2. new_smf (see nage 

3. register any new Dersons (see page k%) 

^. use "uomf* to add each person to the project (see page 
5k) 

5, delegate the project if requested (see page 33) 

You may batch several projects in step 1» of course* and do many 
registrations in step 3. 
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To add a user to an existing project* you use the tool "uomf". 
(see page 5**.) If the user is not already registered* uomf will 
tyoe a warning message. If you get this message* register the 
user with "register". (see page kS») 

To delete a user from a oroject, use the tool "domf". (see Dage 
35.) The user will remain registered as a person, and his 
address and oassword will remain in the system. If the user is 
leaving the installation, and is not exDected to return, you 
should not remove him from the urf and pnt immediately, since his 
name may be on some access control lists. For instance, if the 
person named "Jones" quits the company, it would be unwise to 
remove the name "Jones" from the user registration file right 
away? sunoose someone else named Jones arrived the next day. 
When he was added to the system, he would have access to some 
segments which he should not have. The unrestricted system 
administrator's tool "remove_user" can be used to completely 
remove a user from the PNT and user registration file. 
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This section deals with making and keeping the system secure* A 
system may be run loosely or tightly* but some security is 
necessary even if the installation does not care if resources are 
mis-appropriated* Security measures not only frustrate immature 
individuals* they orovlde insurance that accidents will not 
destroy the system, and provide Information about what happened 
when something went wrong* 



3.1 passwords 

Each registered Multics user has a personal password* This 
oasswor j is his personal property, and is associated with the 
person* not the user identity (combination of person and 
project)* Project administrators need not know the passwords 
associated with the persons working on their project* although 
since the project administrator usually assists In getting a new 
user registered* he may know it* 

Passwords are stored in scrambled form internally within the 
system* Once a user's password Is entered (via the "register" or 
"change" commands) it is not stored in readable form anywhere in 
the system-administration data bases* When the user attempts to 
log in, the password he types is subjected to the same scrambling 
transformation, and the scrambled values are compared* This 
procedure makes It fairly difficult for a user to obtain another 
user's password, even If he Is given access to the ont by 
mistake • 

» 

The password mechanism is the strongest protection feature In 
Multics? if users cannot be uniquely Identified, then different 
access control rights cannot be granted* Users should be 
encouraged to keep their passwords private, and to change them 
often* Sensitive passwords, in particular, should be changed 
regu I ar I y • 

Users may now change their own passwords dynamically, by use of 
the "-change_oassword" argument to login. They should be 
encouraged to do so often* Once a user has changed his password 
by use of this login option, subseauent installations of the PNT 
will not reset the password* The "chpass" administrator command 
will continue to work though, since It uses the program 
"pass_ut i I" to modify >system_control_dir>ont directly* 

The answering service keeps various counters In the PNT regarding 
the use of a password* In particular, the system counts 
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incorrect passwords, and can type a message to a user at login 
informing him how many times his password has been given 
incorrectly since its last correct use. This feature may alert a 
user that someone has tried to guess his password* 



8.2 Access control 

Access control is the system's second major line of defense. 
Consult MPM sections 1.2.6 and IT. 3 for an explanation of the 
mechanism. Properly set, the access control mechanism can make 
the system very secure* at the cost of some inconvenience* 

Access control works only if user identities are held secure. 
This is the reason that person Identifiers are assigned only by 
the system administrator? otherwise. a clever project 
adm in istr at or could register an identity which corresponded to 
some name already on an access control list somewhere in the 
system* and so be able to log in and use this access control list 
entry for a purpose not foreseen by the creator of the ACL entry. 

The general principle to apply is that no user should have write 
access to any system data base unless there is a good reason. 
Those few, trustworthy individuals who may modify system data 
bases should be impressed with the fact that they should not use 
the privilege casually. It is a good idea to run an absentee lob 
occasionally which soot-checks the access control lists on system 
segments to make sure that something has not been left 
unorotected inadvertently. 

The question of read access is less clear. It is possible to 
prevent users from reading anything except their own directories 
and their contents, or one can leave most of the system readable. 
Two specific cases are interesting? the choice between "e *.».»•• 
and "re on the CACL of >user_dir_dir makes the difference 

between users being able to tell who is registered on another 
project or not. The access control list on 

>system_control_dir>answer_table makes the difference between one 
logged-in user being able to determine another user's process id 
without permission and not. 

Currently, the system is slightly deficient In that the SysOaemon 
anl SvsAdmin users have far too much power. Someday, we will 
change the system to lock the daemons into subsystems which 
cannot execute any but carefully-checked commands, and we will 
remove most global access rights, either getting along without 
them or accomplishing them in lower rings with lots of checking. 
As the system stands now, disclosure of a SysOaemon or SysAdm In 
password ooens the system up completely. In the future, it would 
be nice to have the system secured to the point where no major 
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breach of the system's segment security could be accomplished 
without entering the machine room. 



8.1 Telephone line security 

Tapping a phone is very easy* If sensitive data* such as 
passwords* are transmitted by phone* the system is no more secure 
than the telephone connection box. An installation which thinks 
it is worth the trouble to protect against this sort of potential 
oroblem could consider dedicating GIOC channels to 
special -purpose uses such as daemons and administrative 
operations. The privileged users could then have start_up.ec 
segments which logged out if they were not invoked from the 
proper channel. Consoles on these dedicated channels could be 
hard-wired if close enough to the GIOC (there are other good 
reasons to do this) or could be connected over dedicated 
telephone lines* perhaps even with a pair of the "scrambler" data 
sets which are available commercially. 



8.** Terminal 10 codes 

If the terminals used on the system identify themselves with an 
10 code* it is often easy to track down what terminal was 
involved in a security breach. Me are considering a method of 
restricting use of the system by using terminal ID codes* as an 
optional feature. Since these 10 codes can always be faked* one 
cannot rely on this feature alone. But if terminal ID Is free on 
a terminal you are considering* definitely get it. The program 
"consol e__report" is used to produce a listing of all terminals by 
10 code, with the list of users who used the terminal during the 
month. 



8.5 Use of the log segment 

The program "da 1 1 y_l og_orocess" can be used to monitor system 
operation by setting up its I og_se lect_f i I e to watch for 
conditions of interest. The version provided with the system 
will create a full log of all events* a log of all "interesting" 
events for system programming, and special logs for absentee 
problems and network oroblems. This segment can be edited as 
necessary to monitor specific individuals, or specific terminals. 



8.5 Cross-checking in the billing process 



It is very hard for any user to get away with using Multics 
resources without leaving some traces. Even if someone gets 
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longed in on a system administrator identity* and attemDts to 
fudae the accounting records to conceal the fact that he logged 
ir, most usaoe is recorded in more than one olace. Unless the 
thief figures out how to oaten all of the usage data* some 
accounting program will oroduce a w d iscrepanc y " comment. 



9.7 Machine-room security 

It is not always necessary to run the facility like Fort Knox in 
order to decrease the chances for security breach substantially. 
Tf the general orinciole of having only operators or accompanied 
visitors is established* if outout Is distributed outside the 
computer room and users are not allowed to hang over the 
operations consoles* and if users are not allowed to mess with 
the machine when it is down, most possibilities for orobfems will 
be eliminated. 



8.8 Taoe security 

If users can walk off with dump tapes* or mount them for 
themselves* the storage system is not at all secure. Work Is 
currently going on concerning the design of high-quality 
detachable media secuitv measures. 



8.9 What to to after a breach. 

Once the administrator finds out that someone has used a password 
he shouldn't have been able to* what does he do? Partly* the 
answer depends on what kind of problem has occurred. Clearly* 
all sensitive passwords should be changed simultaneously. Date 
and time modified of all segments should be checked* to see what 
has been changed. Prints of the logs and accounting segments 
should be made and cross-checked. Consider a complete reload. 



8.10 Password trap 

The answering service maintains a "trao" flag in the PNT* in each 
user entry. By using the program M pass__ut i I"* a system 
administrator can cause this flag to be set on. Whenever the 
oerson logs in, a message will be typed on the initializer and 
filed in the log* remarking that the password has been used. No 
indication that this has haooened is given to the user. This 
fp-^ture can be used when you suspect that a certain password has 
been compromised and you wish to catch the fellow red-handed. 
Since the terminal ID and channel number are typed in the 
message* it is often easy to locate the user. There is another 
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flag which may be set, which "locks" the password, without 
changing it, (As a matter of fact, the user may even change his 
password while it is locked*) The user will be unable to log in 
if his password has been locked. 

The incorrect password counter mentioned in section 8.1, and the 
identification of the terminal from which the last bad password 
was Issued, are also stored in the PNT, 

The system administrator may also choose to set an entry in the 
system message table to cause a user to receive a "blast" message 
whenever he is logged in and someone attempts to log in with the 
same name, project, and password. This feature may alert the 
user to the fact that his password has been compromised? it is 
also useful in some cases of network use, since a user may log In 
from a remote host which then goes down without Informing Multlcs 
if the user then attempts to log in via some other network 
route, the blast message sent to the first instance of the user 
will cause him to be logged out. 
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Disk storage accounting is done by a se I f -r eschedul ing absentee 
lob, as described in chapter 5. A byproduct of this process is a 
list of all orojects which are low on disk. The administrator 
responsible for disk should attempt to give enough disk to all 
projects to allow them to keep operating. If prices are set 
correctly, this will always be Drofitable until the time comes to 
exoand the building housing the computer* 

If sufficient quota is avalable on >udd to satisfy a project's 
need, all the administrator needs to do is to type 

movequota >udd>Pro1 INCR 

to increase the storage available to ProJ by INCR records. 

To generate more quota on the system, do a setquota o_n t he root 
pnl v either from the initializer console or via "sac", and then 
move the quota down to >udd, as follows? 

sac "sq > 3000? mq >udd 1000" 

suoposing that the root quota is normally 2000. 

It is Dermissible to have more quota allocated than is physically 
available. The acuta! amount of overal location depends on how 
fast the community uses up quota and how closely the disk quota 
is watched? this can be determined only by experience. Caution in 
this process is recommended, because the system crashes if it 
runs out of space. 

For more discussion on this point, see section 13.1 (page 86). 
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If the system crashes while running the crank* a flag will have 
been set which prevents the crank from running again until the 
state of the accounting segments is determined, (This flag is 
the variable "abor t_cr ank*" in value_seg.l The various programs 
in the crank have been planned so that they can be re-run without 
ill effect, whenever possible. The first thing to do is to 
examine the absout file produced by the crank, to see what the 
crank was doing when it was interrupted* Next, check the date 
and time modified on the segments in >syst em_contro l_d ir and the 
segments in >udd>Sys Admin>admin, and confer with operations to 
make sure that no files were backed up due to a reload. 

Usually, at this point, it is possible to use the editors to 
create an exec_com file which consists of the remainder of the 
steps in the crank, and then to execute it on-line. 

In some cases, data which was lost may be regenerated? for 
instance, if "projflle" Is lost, you should retrieve a copy, use 
"eoro" to add any projects which were added since the copy you 
have, and to edit any other entries which changed, and then 
re-run the disk report to recalculate the oroject usage* It Is 
difficult to provide a fool-proof prescription for recovery, 
since what must be done depends on what segments were lost or 
damaged. If your investigations seem to show that all is well, 
type 

value$set abort_crank false 
to allow the crank to run again. 

Oo an "lar" to make sure the crank and disk reoort Jobs are 
scheduled. If not, do a "setcrank" and/or "setdisk". 
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There are two situations of interest concerning accounting setuo. 
The first concerns the startup of accounting at an installation 
which has never had a Huftics before — this is called an 
"accounting cold start". The second concerns the modifications 
necessary for an installation which receives a new distribution 
of Multics* with significant changes to the accounting package 
which may require the reformatting of segments* or other 
modifications, in order to continue to operate. 



11. i Accounting cold start 

Accounting cold starts are supported by the exec_.com segment 
acct_s tar t_up. ec 

which is distributed as part of the system libraries. In 
general* all that the local installation need do is* on its first 
successful bootload, enter admin mode on the initializer and type 

ec acc t_s tar t_uo cold 

and then follow instructions. 



11.2 Accounting warm start 

Although some work has been done on designing an accounting 
warmstart, the supplied procedures may have defects if you are 
upgrading more than one level of accounting system in a Jump* or 
if you have made modifications to the supplied accounting 
procedures for support of local installation features. It is 
imoerative that you study and understand the contents of 
acct_star t_uo.ec before executing them. Read both the cold and 
warm start sections. The warm start procedure is designed to 
upgrade the accounting system from the previously-distributed 
level to the new level? If it looks like it will work, you may 
tyoe 

ec acct_star t__UD warm 

from the initializer console. As of this date, no general 
accounting-distribution procedure has been developed. This 
deficiency in the system will be corrected, module by module, as 
time permits. In the meantime* the best thing to do is to read 
the exec_.com and skip those steps which look like they would 
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dps troy data. 

Pay careful note to the header of the SAT which is created by the 
coldsta*~t. If your SAT header does not look like this* you way 
need to change the default attributes. 

It is a good idea to at the very least reconvert the SAT* via 
"new_smf", and reinstall it. It cannot hurt to recompile all 
D 0T's and reinstall them too. Delegated projects may be a 
problem here. If the format or contents of the POT changes in 
such a way that this steo is absolutely necessary* a conversion 
Dr-> gram will be suoolied. 

Examine the segments created by the coldstart. If you don't have 
any of them, execute that section of the col dstart which creates 
t h^ro. 

Th^» segment bound_admi n_o I d_ contains programs which used to be 
na^t of the system administration subsystem, but which have been 
obsoleted. The orograms in this bound segment are sometimes used 
for conversion from one level of the accounting system to the 
next. 



11.3 Local Installation parameters 

Host installation oarameters used in the operation of the 
administrative system are kept in the segment 

" ins t a 1 I a t i on__narms". The standard accounting cold-start 
exec_com segment sets these parameters to the MIT values, in most 
cases. A discussion of each oarameter follows. 



11.3.1 Shifts 

System usage may be divided into uo to eight shifts, numbered 
from 0 to 7. These shifts may begin at any half-hour during a 
weekt the current shift is the same for everyone, and the shift 
is the same at the same hour during every week. There is 
currently no provision for over-riding the regular shift 
mechanism to account for holidays. Shifts are set by filling in 
a table which contains 336 entries, one for each half-hour in the 
week, with a digit from 0 to 7, At MIT, we use only shifts 1, ?, 
3 and ^, and the hours a^e? 

shift 1 0800-1300 weekdays 

shift ? 1800-2^00 weekdays 

shift 3 0000-0800 every day 

shift tf 080 0-2^00 weekends 
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11.3.2 Shift orices 



Prices may be set for CPU timet connect time, process time* core 
usage* and device usage on a pei — shift basis. The current 
mechanism does not actually generate any charges for any but CPU 
and connect time. Later versions will distinguish between 
connect time and process hours* to allow multiple processes per 
user and multiple terminals oer user? we will also implement core 
charging and device channel usage charging. Any installation 
may* of course* set the orices for some resources to zero and use 
other administrative means to control resource usage. 

The calculation of the proper price for the use of a resource has 
been the subject of endless argument. Every local installation 
will have its own special way of computing these rates. The 
method we have evolved at MIT is the followlnqf first* we list 
all costs involved in running the service. This includes 
programmer and operator salaries* cards and paper* hardware 
rental, and modems. (Desired orofit or planned loss could be 
included we attempt to break even.) These costs are then 

attributed to cost pools* pne for each resource which is 
chargeable. Resources which cannot be attributed to the cost of 
providing a particular service* such as operator salaries or the 
motor generator* are lumped in the category "overhead*" and the 
cost of this pool is soread proportionally over the others. Each 
pool's cost is then divided by estimated paying-customer usage* 
to obtain a "break-even price.'" These figures are then fudged to 
make reasonable prices. If an estimate is uncertain* we rpund up 
strongly. For shift differentials* we use the following tablet 



shift 1 115?. 

shift 2 90% 

shift 3 502 

shift k 802 



of break-even 



We also usually round the shift prices up to the nearest multiole 
of $.50 oer minute* Just to make the prices easy to remember. 

The prpgram "price" is available to interested system 
administrators from T. H. Van Vleck? it mechanizes the pricing 
philosoohy discussed above. 



11.3.3 Installation 10 and titles 



Instal I at ion__parms contains the 32-character installation 10 
field which is typed out when a user dials up. This should 
contain both the company and department abbreviation* and the 
city an1 state. For example* 



Huftics System Administrator's Manual 

01/C9/73 



Page 77 
rev y. 



Chinter 11 Setting uo Accounting 



MIT, Cambridge, ^ass. 

The installation titles are longer character strings, returned by 
the program syste m__ info tit I e s » which are used at the too of 
each page of the monthly bills and in many other reports. There 
are two strings, the company name and the department ID. Both 
strings are entered twice, once s i ng I e-sraced and once 
double-spaced. For example, 

Massachusetts Institute of Technology 
Information Processing Center 

and 

Massac huset t s . • • • 

Loca I I y -wr i t ten administrative tools should, of course, use these 
titles so that they can be exported to other installations. 



11.3.<+ Miscellaneous parameters 

The maximum time allowed for a login timet the cycle time between 
initializer accounting updates, and the maximum inactive time 
before automatic logout for a normal user are all given in 
seconds in ins ta I I a t i on_parms • The number of login tries a user 
may have before the system hangs up on him is also specified 
t here . 

The usual values for these parameters are! 

inac t i ve_t Ime 15-90 mins. 

warning_time 3-5 mins. 

Iogin_time 3-5 mins. (more if noisy lines) 

acct_update 10-60 mins. 

login_tries l-*f 

Those values may be modified according to the needs of the 
installation. The ranges given are reasonable limits* though. 
Fo^ example, the accounting update cycle should not be too small, 
or initializer time will go way up, and it shpuld not be too 
la^ge unless the system hardly ever crashes, or revenue will fall 
off. Consult the SPS writeuo of the ed_instal lati on_oarms 
command for more information. 



11.3.5 Messages 

Ins ta I I at ion_parms also contains the messages typed out on the 
user's console if his account is out of funds, nearly out of 
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funds, oast its termination date* or nearly past its termination 
date* We out the teleohone number of the User Accounts Office in 
these messages, to make sure the user knows who to call* 



11.3.6 Daemon and absentee rates ' 

These rates are kept in insta I I at i on_oar ms , in an item named 
"queue". Absentee CPU and real-time prices are stored by queue* 
as are 10 daemon rates oer 1000 lines* Queues one through four 
may have rates set* 



11*3*7 Absentee "timax" parameter 

The scheduling priority for a Multics process is calculated by 
the scheduler by a comolex algorithm which takes several factors 
into account. Consult the MPM SPS for the details of this 
calculation* For system-administration purposes* what is 
important is that each process* when it is created* is assigned a 
parameter called "timax", which limits the depth to which the 
process may sink in the scheduling queues* Interactive processes 
are assigned the default timax, which is currently 8000000 
microseconds* The timax value for absentee processes* however* 
is obtained from insta I I at lon_ parms, and may be different for 
different queues* A larger number will allow a lower queuet at 
MIT, we set all queues to have a timax of 16000000* This means 
that absentee Jobs sink rapidly to the bottom of the queues, 
where they are given relatively long CPU time limits, and that 
interactive users will always get better response than absentees. 
By setting the values associated with the item "timax", an 
installation may experiment with other values for the absentee 
t imax • 



11.3,8 Configuration Table 

A table is kept in "insta I I at ion_parms" which describes each of 
the system configurations which an installation will use, by the 
number of CPU's, number of SkK memories, and shift. For each 
such entry, the table contains the value of the maximum number of 
load units allowed on the system, the maximum number of absentee 
users allowed, the highest-numbered ( I owest -or ior i ty) absentee 
queue from which Jobs will be run, and two response control 
parameters. Unless automatic adjustment of maxunits has been 
disabled (see the writeuo of "admin" in the SPS, and the operator 
command writeuo of "maxu") , this table will be referenced to set 
maxunits whenever the system is brought up, whenever the s*i f t 
changes, and whenver the system configuration changes. The 
configuration is looked up in the table, and maxunits and the 
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absentee maxima are chanqed. 

If response control is enabled, the system will attempt to adjust 
maxunits on every login and logout, so that the average queue 
length falls between the "low" and "high" values* Maxunits will 
be increased whenever the average gueue length is below "low"! it 
will be decreased whenever the queue length is above "high"* and 
it will be set to the current number of users whenever the queue 
length is between "low" and "high". 

The order of the elements in the configuration table is 
significant. The elements should be in order by number of CPU's, 
within that by number of memories, and within that by shift! 
smaller numbers first. The lookun will continue as long as anv 
table element is less than the value being looked uo, so that an 
element sepcifying 9 CPU's, 100 memories, and shift 8 will always 
ston th? lookuo. This feature can be used if, for instance, your 
installation does not wish to have different parameters depending 
on shifts instead of having eight table entries for each 
combination of CPU and memory for shifts 0-7, you may supply only 
one entry, which has a shift number of 8, 



11, <+ Runtime constants in value_seg 



The symbol-table segment value_seg Is used, with the active 
function value, to insert certain i ns ta 11 at i on- var i ab 1 e 
parameters into the ©Derations conducted by the master exec_com. 
The most important of these values are 



cr ank_t i me 
di sk t ime 



the time of day that 

the time of day that 
runs (this should be 



the crank runs 

the disk accounting 
before the crank) 



admin__addr address, in dprint header, of system 

adm ini str ator 

accts__addr address, in dprint header, of system 

accountant (user accounts office) 

directorX_addr addresses, in dprint header, of 

directors (currently, up to 7 may be 
named) 

abort_crank "true" if crank is to abort, else 

"false" (see section 5) 



sysa_addr address, in dprint header, of system 

assurance 
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sysprg_addr 



address* in dprint header, of system 
programmer 



admi n__on I ine 



person and project id of user to send 
"crank ran" message to 



I og_number 



current 
processed 



number 



of 



log segment being 



The critical values are set to reasonable values by the 
accounting coldstart. they may be changed with the valuetset 
command. The command " va 1 ue$dumo" may be given to type out all 
values in value_seg. If the various addresses in the dprint 
header are set to "skip", the "rqm" and "rqbill" commands will 
skip printing of the corresponding copy of the file. 



11.5 Modifications to the exec_com segments 

Some installations may wish to build additional administrative 
tools and insert calls to them into the cooies offl*aster«ec and 
biller.ee which are used by the local system administrator. In 
particular, most installations will wish to remove the call to 
punch_MIT_deck from the monthly billing and insert something more 
appropriate to their own needs. This is easy to do, since the 
system- 1 i brary copies of the exec-corns are copied into 
>udd>SysAdmln> I ib. It is a good idea, though, to keep careful 
notes on what modifications were made to the segments and why, so 
that the changes can be made again after a new version of the 
accounting package is distributed with a new system version. 



11.6 Load control group table 

Consult chapter 1*+ (page 89) for information on the system 
parameters which control the load control facility. Note that 
setting up load control requires determining what groups are 
required and which projects belong in each group, and then 
deciding how much of the system maxunits each group should be 
able to occupy. These decisions require some picture of the 
normal load pattern of the system, as well as knowledge of the 
priprities attached by management to individual prpjects. 
Installations which are Just starting up should probably being 
with Just two groups, "System" for the system users such as 
daemon processes and other uses which are "part pf the system*", 
and "Other" fpr everybpdy else. If significant system 
programming work will be done on the system, a group for the 
system programmers — those on the project "Multics" — may also 
be necessary. 
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11.7 System Message Table 

Answering services numbered 6.12 and higher make use of a SDecial 
system facility to allow local installation replacement of all 
answer i ng-serv ice produced messages to users* without 
modification to the code in bound_user_cont ro l_. The unbound 
segment as_error_tab I e_ may be replaced by an Installation to 
tailor the messages typed out by Multics to local installation 
requirements. 

The procedure for modifying a message is quite simple? a system 
orogrammer edits as_e^ r or _t ab I e_» e t to modify the text of the 
message t comoiles the segment via err or_t ab I e_comp i I er and aim, 
and installs the new system message table. 

Several of the entries in the message table are actually format 
strings for loa_. These items may be edited, but the 
data-transmission items in the format must, of course, remain In 
the same order. 

If the installation does not wish to have some of the messages 
typed by the system, it may choose to make the text of the 
messages null in the table. For example, to suppress the "Last 
login was..." message, the following line should replace the 
statement for " I ast_l o g in_msg" In as_error_ta b 1 e_. e t t 

1 ast_J ogin_msgJ lliwas,: 
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Several special user identities are built into the organization 
of the iultics system* or are referred to by the documentation by 
name. This section describes the various special identities and 
their oecul iari t les. 



12.1 Full system administrators 

Full system administrators are users on the project "SysAdmin" 
who have the normal initial procedure* M process.overseer_ H . 
Since they have potential write access on every segment in the 
system* and since they may access the highly-privileged gate 
"hohcs_" and the privileged gate M phcs. w » they can cause great 
damage to the system by inappropriate execution of a command* 



12.2 Restricted system administrators 

Restricted system administrators are users on the project 
"SysAdmin" who have the special initial procedure* 
"accoun ts__overseer_". This program allows them only a small set 
of innocuous commands* and the ability to execute any function 
contained in the segment "master. ec". A great deal of 
self-checking is built into the command sequences contained in 
"master", so that a non-programmer can be trained to operate as a 
restricted system administrator. 



12.3 IO.SysDaemon 

The 10 daemon has control of the printers* readers* and punches 
on the system. Its initial procedure is "daemon__exec_". The 
daemon is special in that It has write access on the daemon 
queues contained in 

>daemon_dir_dir>io_daemon_d Ir 

so that it may remove processed requests from the queues. The TO 

daemon does its accounting in the segment "TO accounting" in 

>system_con tro l_dir • Excepte when it is in the procedure 
"act_ctl_" it has no access to segments in >sys t em__cont ro l_dir* 
to prevent users from requesting prints of the password segment. 
The project "SysDaemon" and the user "IO.SysDaemon" have the 
"multio" attribute flag* so that the 10 daemon can be logged In 
more than once* in order to run more than one printer. 
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12. Backup • SysDaemon 

Th« Backup daemon ooerates in ring 1, instead of ring so that 
it may 1umo all segments which are part of the hierarchy. It 
comes uo in ring 1 bcause the statement 



has been added to its omf entry in "SysDaemon. pmf", and because 
the smf gives permission to SysDaemon to have users log in In 
lower rings because it has the statement 



in the pm f entry for the project "SysDaemon". Its Initial 
procedure is "nrocess_o verseer_". This user has soecial access 
rights to all directories on the system* through the medium of 
the SPACL. 



12.5 Dumper . SysDaemon 

The Dumoer daemon is used to perform complete dumps of the 
hierarchy. It is otherwise Just like Backuo. SysDaemon. 



12.6 Re tr iever .SysDaemon 

The Retriever SysDaemon is used to retrieve user segments from 
complete or incremental dump tapes. It operates in ring 1, and 
its initial procedure is "process_o verseer_". It is on the 

SPACL. 



12.7 Trans I ator. SysDaemon (obsolete) 

The Translator daemon has been eliminated* now that absentee is a 
regular facility of Hultics. It reoresented a potential security 
hole in the system* since it attemoted to write segments in the 
user a^ea» and could have ended up writing segments which were 
accessable to *• SysDaemon but not to the user. 



12.8 Ri ng_i_Repair. SysDaemon 

This user comes up in "pr ocess__overseer_", but in ring 1. This 
is the only user who can execute any command from the console in 
ring 1, This identity is used to fix problems with access control 
in ring 1, The nassword for this user is keot in a sealed 
envelope in the operations area. 



r i ng : 



1, 1? 



r i ng ? 



l, 7: 
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12.9 Reoa ir .SysDaemon 

This user identity is provided for evergency fixes by system 
programmers who need SysDaemon access privileges. The password 
for this user Is kept in a sealed envelope in the operations 
area* 

12.10 Repair. SysAdmin 

This user identity is provided for emergency fixes by system 
programmers who need SysAdmin access privileges. The oassword 
for this user is keot In a sealed envelope in the operations 
area. 



12.11 Network Oaemon 

This user is logged in to provide the functions associated with 
the Network Control Process, Its "star t_jjp.ec" segment brings uo 
the network, and then monitors the operation of the network. The 
primary functions of this user are to assist In the Initial 
connection between foreign hosts and the system* and to perform 
segment-transfer operations. 



12,12 anonymous users 

Anonymous users are al I given the access control ID "anonymous 0 
Instead of a person ID, Their usage is aggregated on the monthly 
bill and the statistics under the heading "Student Users", The 
"who" command lists them as "anonymous"* and the "as_who" command 
lists them with a star in front of the name. There is no reason 
why an anonymous user cannot be a project administrator. 



12.13 Fictitious persons 

Sometimes* a project wants to register a full user identity which 
corresponds to no real person. This practice will work, but 
should be discouraged unless a good reason can be advanced, since 
it tends to circumvent the access control mechanism. To add a 
fictitious person, type in the name pf the real person in charge 
of the identity to the register command, preceded by an asterisk, 
"register" will then know that it should not attempt to generate 
a userid from the name, and will ask for the userid. The names 
beginning with asterisk will be skipped when mailing labels are 
generated from the urf. 
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12.1** Project Administrators 

Project administrators are registered Multlcs users who are in 
charge of some rroject. They need not be registered on the 
oroject they administer. A single user may be project 
administrator for many projects. Each project administrator 
appears in the smf entry for the project he administrates. He 
has a copy of the project's pmf* and may install a pdt which he 
creates from this pmf with cv_omf* by use of the install command. 
The oroject administrator must be able to read "pro J _adm 1 n_seg" 
in order to use the install command* and he must have "ea" access 
on the directory >syst em_con tro l_d ir>uo date in order to out the 
copy to be installed where the system can discover it. 

Project administrators should be trustworthy people. They should 
be told to aoooint an alternate if they go on vacation* since it 
is difficult for a system administrator to run a project which 
has been delegated to someone else. 



12, IS Project "Multics" 

Users on the "tfultics" oroject are able to access the privileged 
gate "ohcs_" to investigate the contents of the supervisor. 
Since they can, therefore* steal passwords from the inout 
buffers* only responsible system programmers should be registered 
on this project. 



12.16 Terminal repair 

The project "Terminals" should be set up with one anonymous user 
whose initial procedure is "term ina 1 s_o verseer__" so that 
remote- term ina I service personnel can login and check out a 
terminal. Bumping should be on* and a grace of only 3 minutes 
set . 



12.17 System operators 

All system operators should be registered on the oroject 
"Operator". This provides them access to the system for the 
ou^pose of sending mall* document runoff* and harmless play. It 
is far better to provide them with a small amount of disk space 
and some CPU time of their own, than to discover them using the 
daemons for experimenting with the system. 
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Chapter 13* Full System Administrator Operations 



There are several ooerations necessary to keep the system running 
smoothly which are not yet made into commands for a restricted 
administrator. 



13.1 Disk auota moving 

The daily disk report lists all those projects which are low on 
disk quota. Some of these projects deserve more disk* and others 
do not — they will use uo all that is available. An automatic 
program could be written to give more disk to those in need* and 
to take quota from those projects which had extra* but the 
algorithms Involved would be complicated and a_d, hoc* and manual 
adjustment and Intervention would still be reauired* 

A restricted system administrator can do some of this quota 
moving, since he has the movequota command available* but it 
takes some experience* and is hard to exolain. 

The general strategy is to keep some extra quota on 
>user_dir_d ir * available for giving to new projects or to old 
orojects which are running out of disk. Issuing the command 

movequota >udd>Alpha 50 

will give the project named "Alpha** 50 more records of quota. A 
negative amount will move quota up from a prolect to >udd. 

The difficulty arises when the free quota on >udd runs low. 
There are two poss ibil itiest if the installation has a total 
quota which is already as much in excess of physical capacity as 
should be allowed (for instance* if the disk is over 9 OX 
physically full)* no more quota should be generated. The 
administrator must either take quota from some other project* or 
from some system directory* or deny the request. Knowledge of 
the various projects* activities and moral suasion may have to be 
emoloyed. A "hold*" should be out on new oroject registrations* 
too* since new_proJ will gripe if it cannot christen a new 
project with enough disk. 

If* on the other hand* the administrator wishes to raise the 
total quota on the system* say by 1000 records* he should issue 
the command 

sac "setquota > 3000 * mq >udd 1000** 
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(assuming the quota on the root is normally 2000). The 
"send_adm in__command" (sac) command sends a message to the 
initializer process which will be performed as soon as the 
Initializer gets a chance. The command line executes a 
"setquota" to increase the root quota* and then executes a 
"movequota" to move the quota down to >udd* where it can be 
distributed as usual. 

The sequence described above is the only time that the setquota 
command should be used. This is because the disk-meter ing code 
in the storage system and the disk-accounting program require 
that disk quota form a "connected tree" with no directory which 
has a quota inferior to one that does not. 

See Chapter 9 (page 721 for more information on disk quota 
managemen t • 



13.2 Cleanup of segments 

Giving the restricted system administrator the "delete" command 
would allow him to destroy any data segment on the system. 
Therefore* it is up to the full system administrator to clean up 
segments* especially in >udd>SysAdml n>admin and its 
subdirectories* which are no longer needed. 



13.3 Load control grouo management 

New projects will automatically be assigned to the default load 
control group* "Other", by the new_proJ function. Placing a 
oroject in a grouo requires modification of the segment 
"smf.new"* followed by a new_smf. All that is required is to add 
the I ine 

group? Blah! 

after the "prolectid" statement which defines a project. 
Generating a new grouo is done by running the program "ed_mgt"* 
which is documented in the MPM SPS. 



13. ^ Soecial Project requirements 

Creating privileged projects* or undei — privileged prolects, or 
editing the pmf of a nroject to give it soecial treatment* must 
be done by the full system administrator. Consult the H°M SPS 
writeuDS of cv_smf and cv__omf for more information. 



Multics System Administrator's Manual 
01/09/73 



Page 88 
rev 3 



Chapter 13 



,Full System Administrator Operations 



13,5 Access to project directories 

Access control is the particular province of the system 
administrator. One thing he has to do that cannot be entrusted 
to the restricted system administrator is to provide the various 
project administrators with access to project directories. Tn 
some cases* the system administrator may be called upon to give 
access to one user's segments to a user from some other project. 
It is important to have someone responsible performing this 
function, so that ill-advised or malicious requests can be 
refused . 



13.6 Crash Recovery 

Unrestricted system administrators may be called in to rescue the 
crank or the system administration subsystem if the system 
crashes while some accounting operation is in progress. The 
specific steps to take depend on the nature of the crash and on 
the operations being performed when the system went down. 

The worst crashes are those which are followed by a reload in 
which some accounting files are lost. Sometimes, this may keep 
the system from starting up* or worse, the system may start uo, 
but be using old or inconsistent data. Operations should have 
standing orders to contact a system administrator if segments in 
the administrative directories are destroyed. 

More often, the difficulty is less catastrooh 1 c * for instance, 
the system may crash during a •*new_pro| M * and If the new_oroJ is 
repeated it will turn out that a project is in smf.new twice. 
Restricted system administrators should be told which functions 
cannot be restarted? or told never to do anything more, if the 
system crashed while they were doing something, until the state 
of the accounting files can be checked. 
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Load control groups are groupings of projects which share a 
guaranteed access to the system* Each load control grouo has a 
quota of "primary" load units which represents a guaranteed 
number of users from the group who will always be able to log in. 
Users in excess of the primary quota will be assigned "secondary" 
status and will be allowed to log in if the system is not full. 
Secondary users will be preempted if a primary user wants to log 
in and the system is full. Secondary users may be preempted to 
primary, and their grace recalculated* if a Drimary user from the 
group logs out. 

If a group's primary quota is full and the system is full* a user 
from the grouo will not be permitted to log in unless he is 
oermltted to preempt some primary user In his grouo. This 
preemption is under control of the project administrator* who has 
two parameters he may adjust. In order to preempt another user* 
a new user must have the "preempting" attribute in the PDT* and 
his project must have the attribute in the SAT. In order to be 
preempted* a primary user must have his "grace" expire. The 
"grace" is set by the project administrator in the POT* subject 
to a maximum grace given in the SAT. 

The attribute flags "no_orimary" and "no_secondary" may also be 
set in the POT or the SAT. If a project has the "no_prlmary" 
attribute* none of its users may be primary. Similarly* If a 
project has the "no_secondary" attribute* none of its users may 
be secondary. These flags may also be set by the project 
administrator for individual users. 

The "guaranteed^! ogin" attribute is used only for system 
projects. If a user has this attribute in the PDT* and if his 
project has the attribute in the SAT* then the user will be 
logged in if at alt possible If he specified the "-force" 
argument to login. He may overload the system In the process of 
logging in* or may even have to bump a primary user if the system 
has attained its maximum number of users. 

The accounting system will be set uo with two grouos by the 
accounting cold start. One group is called "System"* and is for 
the use of the daemons and system administration — those users 
vital to the operation of the system. The rest of the users on 
the system will be placed in the "Other" group. To define 
additional load control groups* use the "ed_mgt" command to edit 
the master grouo table. For examole* to add a group called 
"SysProg" and to give it to the project called "Multics"* perform 
the following operations from an unrestricted system 



Multics System Administrator's Manual 
01 /09/71 



Page 90 
rev "=5 



Chapter 1** 



Load Control Groups 



administrator! 

ed_.ni gt >system_control_dir>master_group_table 

a SysProg 5 

w 

q 

edm smf.new 

I orojectid: Multics* 
i group! SysProg- 



ec master new__smf 

The control parameters for a group are its primary quota* 

exoressed as 

constant f max_units * numerator / denominator 

so that the number of units allocated to a group has a guarantee 
and a nortion which varies with the number of units allowed on 
the system? and* ootionally* an absolute maximum number of units 
for the group* primary or secondary. This maximum is also 

expressed as 

constantl + max_units * numeratori / denomlnatorl 

The absolute maximum can be used If you orefer to see the system 
at less than maxunits rather than having many secondary users in 
some group* this strategy may provide better response for those 
users who do get logged in. A orlmary quota of M -i" for a grouo 
indicates that the grouo should take "all the rest" of the 
primary quota on the system, after those groups which have fixed 
quotas have been deducted from maxunits. No more than one grouo 
should have a quota of "-l"* or havoc will result. The total of 
all primary quotas must not add up to more than maxunits* 
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The fol lowing is a list of the wrlteups which contain additional 
information about the system administration facility* its 
programs and data bases. 



Multics System Programmer's Manual 

The published documents on system and user control in 
section BQ are almost completely worthless. They describe 
programs which were never used* and in most cases never 
written. In some cases* one can discover design principles 
mentioned in these old documents which have been followed in 
the construction of today's facilities. 

A completely new section BQ is being prepared* which will 
provide an overview of the system and user control 
facilities actually part of the system. This project is not 
high-priority. 



Multics Programmer's Manual 

See section 1.2, "Logging In"* and the command writeuos for 
"I ogin" and "logout". 



Multics System Administrator's Manual 
This document. 



Multics Project Administrator's Manual 

Describes the duties and powers of the project 
administrator. A copy of this document should be given to 
each project administrator. 



On-line help segments 

See the segments "charges. info"* " I oad_ct I • in f o"* 
"I og in . inf o" * and "user_control • In f o". 
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Hultics Programmer's Manual - System Programmer's Supplement 

The currently installed proqrams which support 
administration and user control are documented in this 
manual * The writeuos to read will be listed by category. 

System Control 

syst em_startuo_ - system ring 1 overseer 

sy st em_contro I _ - system user-ring overseer 

sys_log_ - initializer error messages 

User Control and Answering Service 

absentee_user_manager_ - absentee Job control 

absentee^ t i I i ty_ - absentee Job scheduler % utility 

act_ctl_ - accounting 

admin - operator commands 

as_ - answering service startup 

as_meter_ - system metering 

asu_ - typewriter attachment 

aswa_ - tyoewriter and network i/o 

cp3_ - process creation 

datebin_ - date conversion utility 

dhodh_ - access checking utility 

dial_ctl_ - slave console control 

dlalup_ - line control, login line oarse» logout 

dDg_ - process destruction 

hash_ - hash table utility 

hash_lndex - hashing function 

l3_ctl_ - login decision* user identification 
load_ctl_ - load control decision 
not_ascli_ - string-checking utility 
rehash_ - hash table utility 
scramble. - password scrambling 
test_dialuo - testing tool 
up_pdt_ - odt validation and updating 
up_pnt_ - pnt validation and updating 
uo_sat_ - sat validation and updating 
uo_sysctl_ - system table update control 

Administration and billing 

access_name - add or delete access control names in UCT 

accoun ts__overseer_ - initial procedure for administrator 

adnin_util - lock and unlock sys_admin_data 

as_who - privileged who* for operator and admin, 

char ge_daemon__usage - TO daemon charges from deck to PDT 

charge_disk - charge disk to orojects 

ch ar qe_oro ) ec ts_t o_acc ts - monthly billing 
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charge_user_ - POT modification utility 

char ge_user_regis trat ion - monthly billing 

char ge_users_to_acct s - monthly billing 

c I ear^oro 1 f i I e - monthly billing, cleanup 

c I ear_reqf i I e - monthly billing, cleanup 

compute_bill - daily billing 

console_edit - utility to update termseg 

conso I e_report - generate console reoort by id code 

copy_as_meters - copy stat_seg for statistics report 

cooy_ont - make pnt cooy for testing with blank passwords 

cr aa te_l ines_f 1 1 e - installation startup tool 

cv_persmf - compile persmf into pnt (obsolete) 

cv_pmf - compile pmf into pdt 

cv_smf - compile smf into sat 

daemon_acct_pr int - print daemon accounting deck 

da i I y_l og_orocess - generate reports from log 

dai I y_summary - daily billing reoort 

disk_stat_print - print disk charge figures 

di sk_usage_s tat - sweep disk and print statistics 

disk low - report on projects low on disk 

dunp_anstbl - dump answer table for debugging 

ed_instal lat ion.parms - edit installation parameters 

ed_mgt - edit master group table 

edur f - edit user registration segment 

eoro - edit project segment 

erf - edit requisition segment 

fill_urf - pass through urf, get missing data 

format_at tributes.. - output format utility 

ge t_Dassword_ - oassword reading utility 

get_uid_wi th__l astname - search urf for last name 

get_user_ - monthly billing subroutine 

hash_table - hash table maintenance 

idsort_ - fast sorting utility 

install - install system tables 

is_he_user - active function 

ls_l egal_proJ - active function 

labli - print billing labels 

ma 1 1 ing_ I abe I s - print user labels 

merg - monthly billing 

merge_ur f _pnt - obsolete 

misc - input miscellaneous charges 

new_user - register or change user 

pdt_cooy - cony all POT's to safe directory 

ppro - print projfile 

print_disk - print project disk charges 
orint_log - print log segment 
print_meters - create statistics reoort 
print_pdt - print pdt 
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orint_pnt - orint ont 
orint_sat - print sat 
or ocess__daemon_car ds - daily billing 
or oc ess_sess ion_c ards - daily billing 
proJ_mtd - month-to-date project report 
pro ] _usaae_reoor t - month-to-date project rerort 
ounch_MIT_deck - monthly billing 
qf o - pr int reaf i I e 
remove_user - unregister user 
rename__onts_ - utility for new_user 
rese t_d i sk_meters - monthly reset of disk meters 
rese t_processed_f I ag - oatch accounting deck flags 
reset_usage - reset usage data in PDT 
rese t_use_to ta I s - reset usage totals for reports 
send_adm in_comman d - send command to Initializer 
se t_admin_data_ - locking subroutine for sys_admin_data 
sor t_h is t_f i I e - sort billing data base 
so~ t_oro J f i I e - sort project database 
sor t__r eq f i I e - sort requisition data base 
sweep - disk quota and charge accounting 
sweeo_dlsk_ - disk hierarchy sweep 
sy s_ f u I I _reoor t - report on refused logins 
system _dai I y_repor t - write daily report 
sy s t em_mon th I y_repor t - write monthly report 
system_total - compute system availability for reports 
term Ina I s_overseer__ - terminal repair in i t proc 
uo_ctr - update charges this requisition, monthly 
urfp - print urf 
urfsort - sort urf 

usage_total - compute system usage for reports 

value - active function and command 

wr i t e_acc t_b 1 1 I - monthly billing 

wr i te__bi I I ing_summary - monthly billing 

wr i t e_user_usage_r eoor t - monthly billing 

Data Bases 

answer_tab1e - answering service user database 
communications - system control password 
dlsk_stat - disk charge figures 
insta I lation_oarms - installation parameters 

10 accounting - daemon accounting deck 

log - answering service log 

miscfile - miscellaneous charges journal 

mqt - master grouo table 

odt - project definition table 

pit - process initialization table 

pnt - person name table 
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DroJ _admln_seg - system table installation 

pro] file - project segment 

reqfile - requisition segment 

sat - system administrator's table 

stat_seg - answering service statistics 

sys_admin_data - system administration lock 

ur f - user registration segment 

use_totals - report data base 

whotab - oubllc list of users logged in 

master. ec - system administrator commands 
biller.ec - billing operations 
err.ec - administration errors 
util.ec - administration utility 

acct_s tar t_up • ec - installation accounting startup 
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Aooendix It Sample forms 



Generating a few workflow forms for the use of the user 
accounting office can simplify the operation noticeably. The 
forms will enable you to make sure that the necessary information 
is caotured. Each installation will have its own peculiar 
requirements for these forms f so no general scheme is provided. 
Samples of the forms in use at MIT are attached. 

You will probably want the following: 

person registration form 

project registration form 

project deletion form 

taoe registration form 

retrieval request form 

system problem/complaint form 

credit request form 

card processing request form 

configuration change log 

Roger says 

user accounts all-purpose letter 
user taoe log 

miscellaneous charge inout 
crash form 



backup taoe log 



Massachusetts Institute of Technology 
Information Processing Center 



Person Registration for Multics System 

This form is only needed for oeoole who have never been 
reiiste^ed on Multics before. 



Name 

Last ~* ~" First " Middle 

Mailing address 

Te 1 eohone 



Programmer number (if any) 

Each nelson registered on the Multics system is assigned a 
character "Person ID"* which is unique at this installation. The 
person 10 is usually the last name (beginning with a capital 
letter) if oossible? if someone else with the same name is 
already registered? the person ID will be the last name with 
initials prefixed (e.g. Smith* JSmith* JRSmith). 

Default project TD 

Registered persons must also be authorized to use a oarticular 
orolect by the project administrator for the oroject. 

Please attach a slip of paper with a personal password. Your 
password may be 1-8 characters (letters and digits only). 

You may change your default project ID or your password on-line 
any time you wish? consult the Multics Programmer's Manual. 

Please return this form to? 

Information Processing Center 
User Accounts Office* room 39-513 
M,I*T.» 77 Massachusetts Avenue 
Cambridge* Massachusetts 02139 

If you have any problems with your registration, please contact 
the Use- Accounts Office (253-<til8). 



Name Assigned Date 

by „ 

form revised 9/72 



Massachusetts Institute of Technology 
Information Processing Center 

Project Registration for Multics System 

Project Title . 



Princioa! Investigator 
Address 

Project Supervisor 

Address 

Phone 



Each oroject is assigned a ""Project ID" (i-9 characters beginning 
with a capital letter) for Identification and access control 
ourooses. Please suggest a oroject 10 for your project* 



Initial disk quota records (default 25) 

HIT acct Requisition or P.O. 



If you wish to administer your project on-line, please supply the 
fol lowing information? 

Directory for PMF 



Administrator (Person. Pro J ect) 



Project 10 Assigned Date 

by _ 

form revised 9/72 



Massachusetts Institute of Technology 
Information Processing Center 

Multics Project Administration Request 

TO? User Accounts Office* MIT 39-513 

fpom: 

DATF! 

SUBJECT: Project 10 

[ 1 Please delete the oroject and all its disk storage* Scratch 
all tapes and release all lockers associated with the 
pro 1 ect . 

C 1 Please add the following persons to the project. Person 
registration forms are attached for any persons not 
previously registered. 



C ] Please delete the following persons from the project. Do not 
delate their directories. 



C 1 Please give project administrator status to the following 
user (i.e. delegate the project). 

Directory for PMF 

Administrator (Person • Pro J ect ) 



Date done by 

form revised 9/72 



Massachusetts Institute of Technology 
Information Processing Center 

Multics Project Administration Request Confirmation 

TO! (Project suoervisor) 

FROM t User Accounts Office* MIT 39-513? 253-M18 

DATE! 

SUBJECT: Project 10 

C 1 Your project has been set uo on Multics as reauested. 

C 1 Your oroject has been deleted as requested. 

C 1 The following users have been added to your project. 



t 1 The following users have been deleted from your project. You 
should delete their directories once you have copied any 
segments which you wish to preserve. 



t 1 Your project has been delegated to a project administrator. 
He may now add and delete users and control resource limits. 

Oirectory for PMF 

Administrator (Person. Pro J ect ) 



Date done by 

form revised 9/72 
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